Finding 2025-004: Federal Funding Accountability and Transparency Act of 2006 (FFATA) Reporting (Significant Deficiency) Federal Agency: United States Department of Health and Human Services. Federal Program: Unaccompanied Children Program. Assistance Listing Number: 93.676 Pass-through Entity, if applicable: Not applicable. Award Identification Number and Year: All awards and all of 2025 fiscal year. Criteria or Specific Requirement (including Statutory, Regulatory, or Other Citation): In accordance with 2 CFR 200.332 and as required by the Federal Funding Accountability and Transparency Act of 2006 (Pub. L. 109–282), as amended by section 6202 of Public Law 110–252, recipients must report information for each subaward of $30,000 or more in Federal funds and executive total compensation, as outlined in Appendix A to 2 CFR Part 170. The information is to be submitted to the FFATA Subaward Reporting System (FSRS) by the end of the month following the month in which the subaward was awarded. Condition: During our review of subrecipient activities, we noted that Everstand was not submitting the required reporting under FFATA regulations. Cause: Internal controls over financial reporting were not operating effectively to ensure reporting under FFATA in a timely manner. Effect or Potential Effect: Failure to submit the required reports by the submission deadline results in noncompliance with the Federal Funding Accountability and Transparency Act of 2006 as outlined in Appendix A to 2 CFR Part 170. Questioned Costs: Costs associated with qualitative reporting requirements are not identifiable. Context: We tested a statistically valid sample of subawards charged to Federal awards. The deficiencies noted were consistent across the sample population, indicating a systemic issue rather than isolated exceptions. Identification as a Repeat Finding, if applicable: Not a repeat finding. Recommendation: We recommend that management strengthen controls over reporting requirements for each Federal award to ensure timely submission of required reports.
Reference Number: 2025-021 Prior Year Finding: 2024-054 Federal Agency: Department of Health and Human Services State Agency: Department of Agriculture Federal Program: Research and Development Cluster Assistance Listing Number: 93.103 Award Number and Year: 5U2FFD007445-04 (7/01/2024 – 06/30/2026) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or Specific Requirement: Compliance – Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Agriculture did not include all required information in subaward agreements. Context: One of eight subawards selected for testing were missing required federal award information. The eight subawards tested consisted of six subawards from West Virginia University (WVU), one subaward from the Department of Agriculture (Department) and one subaward from the Higher Education Policy Commission (HEPC). The following exceptions were noted: Department of Agriculture: The subaward tested did not contain all required federal award information. The Assistance Listing Number and identification of whether the Federal award was for research and development was omitted from the subaward agreement. Questioned costs: None noted. Cause: The Department does not have sufficient procedures and internal controls to ensure that subawards are issued in compliance with Federal requirements. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Recommendation: The Department should review and enhance internal controls and procedures to ensure that all required information is included in subaward agreements. Views of responsible officials: Management concurs with the finding and has developed a plan to correct the finding.
Federal Agency: US Department of Agriculture Federal Program Name: Infrastructure Investment and Jobs Act Community Wildfire Defense Grants Cooperative Forestry Assistance Assistance Listing Number: 10.720, 10.664 Federal Award Identification Number, Year and Award Period: ALN 10.720: 23DG11030000019: 7/1/2023 – 12/31/2028 23DG11030000057: 7/1/2023 – 12/31/2026 24DG11030000035: 8/1/2024 – 6/30/2029 ALN 10.664: 20DG11030000007: 7/1/2020 – 12/31/2025 21DG11030000013: 7/1/2021 – 12/31/2025 22DG11030000007: 7/1/2022 – 12/31/2025 23DG11030000008: 7/1/2023 – 12/31/2026 24DG11030000023: 7/1/2024 – 12/31/2027 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Per 2 CFR §200.332 Requirements for pass-through entities, a non-federal entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass_x0002_through entity monitoring of the subrecipient must include reviewing financial and performance reports required by the pass-through entity. Additionally, §200.332 includes required elements that are to be included in the subawards for pass-through entities. Condition: During single audit testwork over subrecipient monitoring, the following issues were noted which are detailed by ALN: ALN 10.720: 5 out of 5 subrecipient samples tested did not have adequate subaward agreements that include the points listed in 2 CFR §200.332 Requirements for pass-through entities. 5 out of 5 subrecipient samples tested listed the incorrect assistance listing number on either the subaward, notice to proceed, or both. ALN 10.664: 9 of 9 subrecipient samples tested did not have adequate subaward agreements that include the points listed in 2 CFR §200.332 Requirements for pass-through entities. 3 of 9 subrecipient samples tested listed the incorrect assistance listing number on either the subaward, notice to proceed, or both. 1 of 9 subrecipient samples were not initially identified as subrecipients for the program due to mapping issues. As result, the Department did not perform any monitoring related to the subrecipient. Questioned costs: None Context: This was identified during Subrecipient Monitoring Testing. The samples described above were statistically valid samples. Cause: The Department has not maintained internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effect: Noncompliance with portions of the applicable regulations. Programmatic monitoring was being performed for the ALNs. Recommendation: We recommend the Department create an agreement template that contains the required elements of a subaward to distribute to its subrecipients. We recommend that the Department conduct training with program staff on required elements of subawards and proper mapping of subrecipients within SHARE.
Finding 2025-046 Compliance with Subrecipient Monitoring for Disaster Grants The Federal Emergency Management Agency (FEMA) Disaster Grants program [ALN 97.036] provides supplemental assistance to recipients to assist communities with responding to and recovering from major disasters or emergencies. The program also provides funding for hazard mitigation measures to help communities implement hazard mitigation projects that can protect them from future disasters. The Disaster Grants program is based on a partnership between FEMA, the recipient (in this case, the Department), and, as applicable, the subrecipient (local governments). FEMA is responsible for managing the Disaster Grants program, approving grants, and providing technical assistance to the state, local, tribal, and territorial governments. The Department, as a recipient of Disaster Grants program funds, is responsible for providing technical advice and assistance to eligible subrecipients, providing support for damage survey activities, ensuring that all potential applicants are aware of funding assistance available, and submitting documents necessary for grant awards. A subrecipient is defined in federal regulations [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. Federal regulations [2 CFR 200.1] define a subaward as an award provided by a pass-through entity (such as the Department) to an entity (subrecipient) to carry out part of a federal grant award received by the pass-through entity. Specifically for this program, the subrecipient is expected to request assistance, as needed; identify the damaged facilities; provide information to support its funding requests; maintain accurate documentation; and perform other work, as necessary. As part of its subrecipient monitoring process, the Department should complete an annual risk assessment to determine the extent of its subrecipient monitoring activities. The risk assessment should include considerations of financial risk factors, such as financial implications of operational and compliance failures; operational risk factors, such as risks resulting from inadequate internal controls; and compliance risks, such as violations with laws, regulations, and internal policies. In addition, the Department should be using monitoring tools to track the status of whether the subrecipient underwent a Single Audit, if applicable, and whether that audit has been reviewed by Department staff and any resulting management decisions issued by those staff to the subrecipient, if applicable, that address the Department’s assessment and planned actions to address any findings or issues identified in the audit During Fiscal Year 2025, the Department passed approximately $76.0 million to 66 subrecipients for responses to various disasters covered by the Department’s Disaster Grants program. In addition, the Department reported that it approved no new subawards during Fiscal Year 2025. All funds passed through to subrecipients by the Department were related to reimbursements for prior period expenses. In total, the Department reported that it had passed through Disaster Grant funding to another 68 subrecipients in prior years who did not receive funding passed through from the Department during Fiscal Year 2025; many of these subrecipients had multiple open projects that had been completed in prior years but were awaiting final approval and close-out from FEMA. What was the purpose of our audit work and what work was performed? The purpose of the audit work was to determine whether the Department had adequate internal controls in place over, and complied with, subrecipient monitoring requirements over the Disaster Grants program during Fiscal Year 2025. Another purpose of the audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendation to review all subrecipients’ federally-required Single Audit reports, as required. The Department agreed with the recommendation and planned to implement it by June 2025. As part of our audit work, we performed testwork to determine whether the Department obtained its subrecipients’ Single Audit reports and issued a management decision, if applicable. We also determined whether the Department performed risk assessments on the subrecipients as required by federal regulations. Finally, we performed this testing over a random sample of 9 of 68 subrecipients that received pass-through funding in the current year. How were the results of the audit work measured? We measured the results of our audit work against the following requirements: • Federal regulations [2 CFR 200.332] require the Department to evaluate each subrecipient’s risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate level of subrecipient monitoring based on the Department’s assessment of risk posed by the subrecipients. Additionally, it requires the Department to verify that every subrecipient is audited as required by 2 CFR 200, Subpart F, Audit Requirements, which sets forth the federal regulations around Single Audit threshold requirements for subrecipients. It also covers the federal regulations to consider whether the results of the subrecipient’s audits indicates conditions that necessitate adjustment to the passthrough entity’s—in this case, the Department’s—own records. Further, federal regulations [2 CFR 200.521] require the Department to issue a management decision, which is defined as the Department’s written determination of the adequacy of the subrecipient’s proposed corrective action to address any findings in the subrecipient’s Single Audit reports within 6 months of the federal audit clearinghouse’s acceptance of the audit report. • The Department’s Division of Homeland Security and Emergency Management’s (DHSEM) Subrecipient Monitoring policy states that it “…will perform an annual evaluation of Subrecipient’s risks prior to the start of each State fiscal year, analyzing active awards and assessing Subrecipients for the upcoming year to determine the financial status of each Subrecipient and which subrecipients will receive on-site monitoring which may include desk reviews.” The policy further goes on to indicate that each subrecipient will receive an overall risk score that is used to determine which subrecipients will undergo monitoring review during the fiscal year based on the quantitative and qualitative data used for the assessment inputs. • The DHSEM Subrecipient Monitoring policy also states that “DHSEM will perform reviews of single audit results for Subrecipients who have expended Federal grant funds in excess of $750,000 of which some portion is passed through DHSEM.” • Federal regulations [2 CFR 200.329] stipulate that the non-federal award recipient—in this case the Department—is responsible for oversight of the operations of its federal award-supported activities. The regulations further state that the “non-federal entity” must monitor its activities under federal awards to assure that compliance with applicable federal requirements and performance expectations is being achieved. What problems did the audit work identify? Based on our audit work, we determined that the Department did not fully implement our prior audit recommendation by its planned implementation date of June 30, 2025, and did not complete required subrecipient monitoring activities for its Disaster Grants program. Specifically, we found that the Department did update the risk assessment policies for the 2025 risk assessment and fully assessed risks for subrecipients for Fiscal Year 2025. However, there was one subrecipient that had not yet issued a finalized audit report and, therefore, the Department’s subrecipient monitoring process was pending completion. Why did these problems occur? Although the Department designated staff to obtain and review Single Audit reports for all of its subrecipients, Department staff stated that they were not able to complete their reviews of previously unreviewed Single Audit reports during Fiscal Year 2025, as letters were still being processed for execution and distribution under the updated policies. The Department also subsequently stated that some of these reviews were incomplete due to the subrecipients not yet finalizing their Single Audits with their auditors. Why do these problems matter? By failing to complete all of its reviews of subrecipients’ Single Audit reports, the Department is out of compliance with both federal requirements and with its policy to complete monitoring reviews for each subrecipient. This could result in the Department not timely identifying enforcement actions that may be needed against noncompliant subrecipients and then making revisions, as applicable, to its monitoring risk assessment for the subrecipient. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-046 The Department of Public Safety (Department) should continue to implement its subrecipient monitoring policy and ensure the Department is in compliance with federal regulations to review all subrecipients’ Single Audit reports in a timely manner. This should also include the Department completing its reviews of the subrecipients’ prior year’s Single Audit reports and issuing the management decision letters for those reports. Response Department of Public Safety Agree Implementation Date: June 2026 The Department will continue to follow the current Policy and Procedure related to the Single Audit reviews and has allocated an individual to review the Single Audits. This includes issuing a management decision letter if required, in accordance with the timeline established in federal guidance.
Finding 2025-047 Compliance with Reporting for the Highway Safety Cluster The Department is required to comply with the Federal Funding Accountability and Transparency Act of 2006 (Transparency Act or FFATA) for its Highway Safety Cluster programs, specifically the State and Community Highway Safety [ALN 20.600] and National Priority Safety Programs [ALN 20.616] (Programs). The Transparency Act was created to empower Americans with the ability to hold the government accountable for each spending decision and, as a result, to reduce wasteful spending by the government. The Transparency Act requires the federal government to make certain information on federal awards available to the public, including information about amounts passed through to subrecipients. The Department is required to report information about subgrants, or subawards, given to other governments or to nonprofit organizations (also referred to as subrecipients). Federal regulation [2 CFR 200.1] defines a subaward as an award provided by a pass-through entity, in this case the Department, to an entity to carry out part of a federal grant award received by the pass-through entity. A subrecipient is defined in federal regulation [2 CFR 200.1] as an entity, usually but not limited to non-federal entities, that receives a subaward from a pass-through entity to carry out part of a federal award; but does not include an individual that is a beneficiary of such award. A subrecipient may also be a recipient of other federal awards directly from a federal awarding agency. The Department is required to file FFATA reports through the System for Award Management website, SAM.gov. Once the Department submits a report to SAM.gov, the public can view certain information from the report, including the subrecipient’s name, subaward identification number, subaward obligation/action date, subaward amount, federal awarding agency and subagency, the Department’s name, and the Department’s grant award identification number. In Fiscal Year 2025, the Department reported approximately $12.9 million in total for the Programs’ expenditures. Of this amount, the Department issued about $6.8 million in subawards under the Programs. The Department had 70 subrecipients with subawards it was required to submit FFATA information for through SAM.gov during the fiscal year. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine whether the Department had adequate internal controls over and complied with FFATA reporting requirements for the Highway Safety Cluster Programs during Fiscal Year 2025. Another purpose of our audit work was to determine whether the Department implemented our Fiscal Year 2024 audit recommendations to strengthen its internal controls over and to ensure it complies with FFATA reporting requirements for the Highway Safety Cluster Programs. The Department agreed with these recommendations and planned to implement them by June 2025. As part of our audit work, we selected 24 Fiscal Year 2025 subrecipient expenditure transactions out of a total of 70 subrecipient transactions for which FFATA reporting was required for these Programs. We obtained copies of the FFATA reports that the Department uploaded to SAM.gov and obtained subaward agreements and purchase orders for each sample. We compared the Department’s subaward information to the information the Department submitted to SAM.gov to determine whether the Department reported accurate information. In addition, we performed testwork to determine whether the Department submitted the FFATA reports within the month following the month it made the subaward, as required by federal regulations. We also tested the Department’s progress in implementing our prior audit recommendations by reviewing their updated policies and procedures. How were the results of the audit work measured? We measured the results of our audit work against the following: • Federal regulations [2 CFR 170] require direct recipients of federal grants to report subawards of $30,000 or more to SAM.gov by the end of the month following the month in which the award was made. For example, the Department would have to submit a FFATA report to SAM.gov in May 2025 if an award or supplemental award equal to or greater than $30,000 was made in April 2025. Federal regulations [2 CFR 200.303] require the non-federal entity—in this instance the Department—to establish and maintain effective internal controls over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. • Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the unique entity identifier, the Assistance Listing Number, the federal award date, and the federal award identification number. What problem did the audit work identify? Based on our audit work, we determined that the Department did not fully comply with FFATA reporting requirements for the Programs during Fiscal Year 2025 and did not fully implement our prior audit recommendations. Of the 24 subaward reports selected for testing, we identified issues on 5 subaward reports (21 percent). Specifically, we identified the following issues: • The Department was unable to provide documentation demonstrating that two subaward FFATA reports related to Fiscal Year 2024 awards had been submitted in SAM.gov. These submissions could not be located in SAM.gov. The amount of the subawards not submitted was $375,553. We further noted that these two reports had still not been submitted during Fiscal Year 2025. • For three subawards totaling $771,258, the Department did not maintain adequate documentation to support the amounts reported in SAM.gov. Specifically, the Department reported amounts of $537,573 for the three subawards, which did not agree to the Department’s subaward records, and represented a difference of $233,684. In addition, the Department did not meet the required FFATA reporting timelines for these subawards. Specifically, one subaward was reported 271 days late and two were reported 301 days late. Why did this problem occur? The Department did not have adequate internal controls in place related to FFATA reporting for the Highway Safety Cluster during Fiscal Year 2025 that ensured that reporting occurred as required for subawards of $30,000 or more in SAM.gov by the end of the month following the month the subawards are made. The Department implemented policies and procedures related to FFATA reporting during the fiscal year; however, Department staff indicated that staff were still being trained on these new procedures. In addition, the Department did not have procedures in place to ensure that, when an unsubmitted FFATA report is identified, the report is subsequently filed in SAM.gov, even if the submission is late. Why does this problem matter? By failing to properly report FFATA subawards through SAM.gov, the Department is out of compliance with federal reporting requirements, risks federal sanctions, and does not meet the federal intent of transparency for federal program spending. See "Schedule of Findings and Questioned Costs" for table/chart. Recommendation 2025-047 The Department of Transportation (Department) should strengthen its internal controls over and ensure it complies with Federal Funding Accountability and Transparency Act (FFATA) reporting requirements for the Highway Safety Cluster by: A. Ensuring that FFATA reporting occurs as required for subawards of $30,000 or more by the end of the month following the month the subawards are made and, if an unsubmitted FFATA report is identified, subsequently filing the report as soon as possible through SAM.gov, even if the submission is late. B. Providing training to Department staff to follow FFATA reporting policies and procedures. C. Ensuring Department staff follow the Department’s FFATA policies and procedures to ensure that FFATA reports are accurate and complete. Response Department of Transportation A. Agree Implementation Date: June 2026 The Department agrees with the recommendation. The Department will review, assess, and, where necessary, update existing procedures for FFATA reporting relating to the requirement that state subawards for $30,000+ be submitted within 30 days of committed budget. This will include ensuring that the confirmation date is documented. This process will be a coordinated effort between the Office Transportation Safety (OTS) and the Center for Accounting. This will include updating our reconciliation process to include additional data, reviewing and updating reconciliation and review procedures as needed, and reconciling Grants awarded in prior fiscal years that are still active and ensuring they have been appropriately reported. The findings related to this recommendation are in part the result of a federal reporting system limitation, and a federal system conversion. The legacy reporting system, FSRS, had a system limitation, which prevented the full amount of the award being reported in the case of three awards. Additionally, this conversion resulted in some data conversion issues impacting one additional award B. Agree Implementation Date: June 2026 The Department agrees with this finding and will provide any training needed to staff members to ensure that all components of the FFATA are completed accurately, timely and with proper reviews. This training will include leadership reviewing NHTSA/Federal guidelines and SAM.Gov training on FFATA reporting and requirements, documenting controls and ensuring the approvers have access to all supporting schedules, forms and systems and that they understand the subawards, and process for late submissions if needed. C. Agree Implementation Date: June 2026 The Department agrees with the finding and will ensure that staff follow all internal policies and procedures to maintain accurate and complete FFATA reporting. To achieve this, staff will review existing procedures and make any necessary updates regarding report compilation. Additionally, we will review control points to ensure they are consistently followed and approved by the team supervisor or team manager.
The following finding and recommendation relating to an internal control deficiency classified as a Significant Deficiency was communicated to the Department of Transportation (Department) in the previous year and has not been remediated as of June 30, 2025 because the original implementation date provided by the Department was in a subsequent fiscal year. This complete finding and recommendation can be found within the original report and the complete recommendation can be found within Section IV: Disposition of Prior Audit Recommendations of this report. Finding 2024-058 Compliance with Subrecipient Monitoring for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and SLFRF The Department receives federal grant funds directly from the federal government for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and the Coronavirus State and Local Fiscal Recovery Funds (SLFRF) program and then subgrants, or passes through, a portion of the funds to cities and counties and other organizations that are considered to be either a subrecipient or a contractor. For Fiscal Year 2024, the Department had the following transactions that were subject to subrecipient monitoring testing: • Formula Grants for Rural Areas and Tribal Transit Program – 783 subrecipient transactions totaling $23,075,270. • Highway Safety Cluster – 829 subrecipient transactions totaling $5,669,865. • SLFRF – 232 subrecipient transactions totaling $38,321,493. For the SLFRF program, Intergovernmental Agreements are executed between the Department and subrecipients to communicate all relevant federal award information. For both the Formula Grants for Rural Areas and Tribal Transit Program and Highway Safety Cluster, Subaward Agreements (subawards) are executed between the Department and subrecipients to communicate all relevant federal award information. Intergovernmental Agreements and subawards are signed by authorized State personnel, generally the State Controller and the Department’s Chief Engineer. The Department includes a “Subrecipient Risk Assessment” tool with its Intergovernmental Agreements or subawards, which must be completed by Department staff prior to making the award. The Department’s subrecipient monitoring procedures are dependent on the assessed risk level noted in the Subrecipient Risk Assessment tool. Federal regulations [2 CFR Part 200 Section F] state that a non-federal entity that expends $1,000,000 or more in federal awards during the non-federal entity’s fiscal year must have a Single Audit conducted in accordance with 2 CFR 200.514. The Department’s Internal Audit Division staff tracks and receives Single Audit reports from its subrecipients. As part of the Department’s monitoring procedures, the Internal Audit Division personnel complete a “Single Audit Report Review Summary” form to show they reviewed the subrecipient’s Single Audit report, summarized any findings, and concluded on any risks presented to the Department and any related future actions to be taken. The form is signed by a Department preparer and a Department reviewer. For those subrecipients not required to file a Single Audit, an “Audit Division Single Audit Certification Form” must still be submitted by the subrecipients to the Department. These forms note that the entity was exempt from a Single Audit. What was the purpose of our audit work and what work was performed? The purpose of our audit work was to determine if the Department complied with federal requirements for subrecipient monitoring during Fiscal Year 2024 for the Formula Grants for Rural Areas and Tribal Transit Program, Highway Safety Cluster, and the SLFRF program and to determine whether the Department had adequate internal controls over subrecipient monitoring. As part of our audit work, we reviewed the Department’s internal controls over compliance for subrecipient monitoring and tested the Department’s compliance with federal subrecipient monitoring requirements. Specifically, we performed the following testwork related to each of the following federal programs: • Formula Grants for Rural Areas and Tribal Transit Program—We selected and reviewed a random sample of 40 subrecipient payment transactions. We reviewed subawards, amendments, and other supporting documentation provided by the Department. • Highway Safety Cluster—We selected and reviewed a random sample of 40 subrecipient payment transactions. We reviewed subawards, amendments, and other supporting documentation provided by the Department. • SLFRF—We selected and reviewed a random sample of 29 subrecipient payment transactions. We reviewed Intergovernmental Agreements, amendments, and other supporting documentation provided by the Department. How were the results of the audit work measured? Our audit work was designed to measure the Department’s compliance with the following criteria: • Federal regulation [2 CFR 200.303] states that the Department, as a federal grant recipient, must “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” • Federal regulation [2 CFR 200.332 (a)(1)] states that the Department’s subawards must clearly identify certain information, including but not limited to, the ALN, the Federal Award Date, and the FAIN. • Federal regulation [2 CFR 200.331] states that a pass-through entity, in this case the Department, must make case-by-case determinations as to whether each agreement it makes for the disbursement of federal program funds represents a payment of funds to a subrecipient or a contractor, depending on the role the entity plays. What problems did the audit work identify? We determined that the Department did not fully comply with subrecipient monitoring requirements during Fiscal Year 2024. Specifically, we noted the following: • Formula Grants for Rural Areas and Tribal Transit Program o For 10 of 40 (25 percent) subrecipient payment transactions selected for testing, we determined the subaward documents did not contain the federal award date in the subaward agreement, as required. The 10 transactions totaled $7,432,248 in subrecipient awards. • Highway Safety Cluster o For 1 of 40 (3 percent) subrecipient payment transactions selected for testing, we determined that the subrecipient should have been classified as a contractor, not a subrecipient. The transaction totaled $75,325. The Department had not made an adjusting entry in CORE to reclassify the transaction and correct this error by the end of our audit testwork. o For 5 of 40 (13 percent) subrecipient payment transactions selected for testing, we determined the subaward documents did not contain the federal award date in the subaward agreement. The 5 transactions totaled $25,100 in subrecipient awards. • SLFRF o For 2 of 29 (7 percent) subrecipient payment transactions selected for testing, we determined that the Intergovernmental Agreement did not include the FAIN and Federal Award Dates. The 2 transactions totaled $3,277,779 in subrecipient awards. o For 1 of 29 (3 percent) subrecipient payment transactions selected for testing, we determined the transaction did not include the ALN. This transaction totaled $1,851,279 in subrecipient awards. Why did these problems occur? The Department’s procedures and internal controls were not sufficient to ensure that Intergovernmental Agreements and subawards included all the required information to be included in the subaward, and internal controls did not prevent or detect errors. Department staff were not aware that this information was needed for the subaward to be in compliance with federal regulations. In some situations, the FAIN was only provided to the Department from the U.S. Department of Transportation subsequent to when the subaward was made. In these instances, the Department was not aware that they were required to provide the FAIN to their subrecipients once it was determined by the U.S. Department of Transportation. The Department’s procedures and internal controls were not sufficient to ensure that payments were properly classified as general disbursements or subrecipient payments, and internal controls did not prevent or detect errors. Department staff lacked the appropriate knowledge of the difference in contractors and subrecipients to ensure the proper classification of expenditures. The Department’s reviewers did not complete a sufficient review of the expense classifications to be able to identify the misclassification and propose a subsequent correction. Why do these problems matter? Based on the issues we identified, the Department is out of compliance with federal subrecipient requirements and could face sanctions or other penalties. In addition, by failing to properly report the required federal grant award information at the time of subaward issuance, subrecipients may be uninformed about what funding the subaward related to. This could result in misclassification of subaward information on the subrecipients’ Schedules of Expenditures of Federal Awards (SEFA) and the subrecipient may not know what federal requirements they need to follow as part of receiving the federal award funds. The Department’s improper classification of expenses as general disbursements versus subrecipient payments could lead to misstatements in the amounts reported on the SEFA, both for the State as a whole and at the subrecipient level. See "Schedule of Findings and Questioned Costs" for chart/table. Recommendation 2024-058 The Department of Transportation (Department) should strengthen its internal controls over and ensure that it complies with federal subrecipient monitoring requirements for the Formula Grants for Rural Areas and Tribal Transit Program, the Highway Safety Cluster, and the Coronavirus State and Local Fiscal Recovery Funds. Specifically, the Department should ensure that all required information is included in subawards or intergovernmental agreements or provide amendments to the subawards or intergovernmental once the Department receives the necessary information from the federal government, and that Department staff are sufficiently aware of the difference in subrecipients and contractors and properly classify general disbursements versus subrecipient payments. Response Department of Transportation Agree Implementation Date: June 2026 Department will strengthen controls to ensure that the required award information is provided, once available. Certain information such as Federal Award Identification Number and Federal Transit Administration and National Highway Traffic Safety Administration award date are not available at the time of contracting CDOT is working on a process to provide this information, once it is available in a publicly available format on CDOT’s website or on a subrecipient facing grant management site. We will add a note to the contract explaining where the information will be posted on our site when it becomes available. The Department will also identify staff requiring additional training on classification and coding for contractors vs. subrecipients.
2025-017: Evaluate Subrecipients’ Risk of Noncompliance in Accordance with Federal Regulations Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-085; 2023-100; 2022-016; 2021-071 Finding Type: Internal Control and Compliance Finding Severity: Significant Deficiency Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: Supplemental Nutrition Assistance Program – 10.551; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program – 10.561; Temporary Assistance for Needy Families (TANF) - 93.558; Child Care and Development Block Grant - 93.575; Federal Award ID (Year): 251VA407S2514 (2025); 2501VATANF (2025); 2502VACCDD (2025); 2502VACCDM (2025) Federal Agency: Various Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.332(b) Known Questioned Costs: $0 As in prior years, Benefit Programs is still not confirming that program consultants evaluate each subrecipient’s risk of noncompliance in accordance with its subrecipient monitoring plan. Benefit Programs oversees the Medicaid, SNAP, TANF, and CCDF Cluster federal grant programs. Benefit Programs disbursed over $425 million in grant funding during fiscal year 2025 from these federal grant programs to over 260 subrecipients. In response to prior audit recommendations, Benefit Programs hired a subrecipient monitoring coordinator in fiscal year 2025 and began creating new materials for managing risk assessments and monitoring reviews, including developing a memorandum detailing the schedule and operation for monitoring activities. Additionally, Benefit Programs developed tracking tools to monitor completion of risk assessments and follow-up activities. However, due to the extent of its corrective actions, Benefit Programs did not complete all corrective actions by the end of fiscal year 2025. As a result, we noted the following deviations while auditing Benefit Programs’ fiscal year 2025 subrecipient monitoring activities: Program consultants did not complete programmatic risk assessments for 17 of 42 (40%) non-locality subrecipients with fiscal year payments. Program consultants did not provide an adequate justification for not conducting monitoring reviews for 11 of 76 (14%) locality risk assessments rated high or medium. Program consultants did not complete 15 of 316 (5%) locality programmatic risk assessments. Title 2 CFR § 200.332(b) requires pass-through entities to evaluate each subrecipient's risk of noncompliance with federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Additionally, Benefit Programs’ subrecipient monitoring plan requires that all staff follow its procedures which guides the process and frequency for ongoing subrecipient monitoring of public assistance programs at local departments. Without appropriate oversight of program consultants, Benefit Programs cannot demonstrate proper monitoring of subrecipient activity, including whether the subrecipient used the subawards for authorized purposes and in compliance with federal statutes, regulations, and the terms and conditions of the subaward. Benefit Programs should continue to implement its planned corrective actions to evaluate subrecipient’s risk of noncompliance in accordance with federal regulations. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2025-016: Review Non-Locality Subrecipient Single Audit Reports Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-084; 2023-098; 2022-013; 2021-072; 2020-075; 2019-091; 2018-092 Finding Type: Internal Control and Compliance Finding Severity: Significant Deficiency Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: State Administrative Matching Grants for the Supplemental Nutrition Assistance Program – 10.561; MaryLee Allen Promoting Safe and Stable Families Program - 93.556; Temporary Assistance for Needy Families (TANF) - 93.558; Social Services Block Grant - 93.6 Federal Award ID (Year): 251VA407Q3903 (2025); 2501VATANF (2025); 2502VAFPSS (2025); 2501VASOSR (2025) Federal Agency: Various Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.332(d)(3); 2 CFR § 200.332(f) Known Questioned Costs: $0 Compliance continues to not review non-locality subrecipient Single Audit reports as set forth within Compliance’s Agency Monitoring Plan. Non-locality subrecipients are subrecipients who are not local governments (primarily non-profit organizations). During fiscal year 2025, Social Services disbursed approximately $125 million in federal funds to 252 non-locality subrecipients. Of the 11 non-locality subrecipients that received more than $750,000 in federal funds from Social Services, we identified two (18%) that did not have a Single Audit reporting package available in the Federal Audit Clearinghouse (Clearinghouse) for the most recent audit period; one of which appeared to have never filed a Single Audit reporting package. Since the prior audit, Compliance adopted a policy regarding how to obtain and review information from the Clearinghouse, compiled a list of non-locality subrecipients receiving federal funds, and worked with Social Services’ Contract and Procurement Team to update contract language that requires the non-locality to communicate anticipated federal spending to Social Services so Compliance can monitor adherence with the Single Audit requirements. However, because of the extent of its corrective actions, Compliance was unable to fully implement its corrective action and review all non-locality subrecipient Single Audit reports by fiscal year end. Title 2 CFR § 200.332(f) requires pass-through entities to verify that subrecipients expending $750,000 or more in federal awards during the fiscal year obtain a Single Audit. Additionally, Compliance’s Agency Monitoring Plan requires the subrecipient monitoring coordinator to reference a comprehensive list of non-locality subrecipients and corresponding federal expenditures, identify subrecipients required to obtain a Single Audit, verify submission of those audits to the Clearinghouse, and follow up with subrecipients that have not complied. Without verifying whether non-locality subrecipients receive a Single Audit, Compliance is unable to provide assurance that Social Services is fulfilling its responsibilities as a pass-through entity. By not reviewing non-locality subrecipient Single Audit reports, Social Services may be unaware of a potential liability to the Commonwealth. Not complying with federal regulations could result in federal awarding agencies temporarily withholding payments until Social Services takes corrective action; disallowing costs for all or part of the activity associated with the noncompliance; suspending or terminating the federal award in part or in its entirety; initiating initial suspension or debarment proceedings; and/or withholding further federal funds for the project or program. Compliance should continue its corrective action efforts and begin reviewing non-locality subrecipient Single Audit reports. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2025-014: Perform Responsibilities Outlined in the Agency Monitoring Plan Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-082; 2023-097; 2022-011; 2021-070; 2020-074; 2019-090; 2018-093 Finding Type: Internal Control and Compliance Finding Severity: Material Weakness Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: Grants to States for Medicaid – 93.778 Federal Award ID (Year): 2505VA5MAP (2025) Federal Agency: U.S. Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.303(a); 2 CFR § 200.332 Known Questioned Costs: $0 The Department of Social Services (Social Services) Compliance Division (Compliance) continues not to adhere to its established approach for overseeing agency-wide subrecipient monitoring, as outlined in its Agency Monitoring Plan. In response to the prior audit recommendations, Compliance made significant revisions to its Agency Monitoring Plan to include tools for tracking and monitoring division-level subrecipient monitoring reviews, began meeting monthly with division-level subrecipient monitoring coordinators, and developed a quarterly variance report that it will use to report the status of the agency’s subrecipient monitoring activities to Social Services’ Executive Team. Compliance adopted its revised Agency Monitoring Plan in July 2025 and anticipates completing the remainder of its corrective actions by the end of fiscal year 2026. Additionally, Social Services hired a director to lead Compliance in fiscal year 2025. Social Services engaged a consultant in April 2025 to help develop remediation plans for its previous audit findings. However, because of the extent of its corrective actions, Compliance could not design and implement its corrective actions by the end of fiscal year 2025. As a result, we identified the following deviations from the Agency Monitoring Plan: Compliance did not review programmatic division annual subrecipient monitoring plans to ensure they implement a risk-based approach. The Agency Monitoring Plan states that Compliance will use a monitoring plan checklist to evaluate and determine if all the required elements for subrecipient monitoring are present in each division’s plan. As a result, Compliance was not aware that the Division of Benefit Programs' (Benefit Programs) non-locality risk assessment template did not include all required risk factors outlined in the Agency Monitoring Plan. Compliance did not confirm that division-level subrecipient monitoring coordinators are maintaining monitoring documentation in Compliance’s centralized repository. As a result, Compliance could not confirm the completeness of the centralized repository. The Agency Monitoring Plan requires that Compliance monitor whether divisions post monitoring review reports to the centralized repository. Compliance did not review each division’s monitoring activities nor provide the required quarterly reports of variances and noncompliance from the Agency Monitoring Plan to Social Services’ Executive Team. As a result, Compliance and the Executive Team were not aware that Benefit Programs did not comply with certain aspects of its subrecipient monitoring plan, such as maintaining complete sampling documentation, monitoring records and reports, and documenting subsequent corrective action. Title 2 U.S. Code of Federal Regulations (CFR) § 200.303(a) requires pass-through entities to establish, document, and maintain effective internal control over federal awards to ensure compliance with applicable laws, regulations, and award terms. Further, 2 CFR § 200.332 requires pass-through entities to monitor subrecipients to ensure they meet federal requirements. Finally, the Agency Monitoring Plan establishes Compliance’s responsibility to centrally coordinate, review, and report on subrecipient monitoring activities across all divisions. Compliance is responsible for agency-wide compliance and risk mitigation that helps ensure adherence to state and federal legal and regulatory standards. During fiscal year 2025, Social Services disbursed approximately $700 million in federal funds to roughly 350 subrecipients from 37 federal grant programs. Without performing the responsibilities in the Agency Monitoring Plan, Compliance cannot provide the Executive Team with assurance that Social Services’ subrecipient monitoring efforts are adequate to comply with the regulations at 2 CFR § 200.332. Additionally, Compliance places Social Services at risk of disallowed expenditures and/or suspension or termination of its federal awards by not monitoring the agency’s subrecipient monitoring activities. Because of the scope of this matter and the magnitude of Social Services’ subrecipient monitoring responsibilities, we consider these weaknesses collectively to create a material weakness in internal controls since Compliance did not implement its corrective actions by the end of fiscal year 2025. Compliance should continue to implement its planned corrective actions to perform the responsibilities outlined in its Agency Monitoring Plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2025-018: Confirm Monitoring Activities are Conducted in Accordance with the Monitoring Plan Applicable to: Department of Social Services Assigned Topic: Federal Grants Management Prior Finding Number: 2024-086; 2023-102; 2022-014 Finding Type: Internal Control and Compliance Finding Severity: Significant Deficiency Financial Statement Finding: Yes Federal Awards Finding: Yes ALPT - ALN: Supplemental Nutrition Assistance Program – 10.551; State Administrative Matching Grants for the Supplemental Nutrition Assistance Program – 10.561; Temporary Assistance for Needy Families (TANF) - 93.558; Child Care and Development Block Grant - 93.575; Federal Award ID (Year): 2501VATANF (2025); 2505VA5MAP (2025); 251VA407Q3903 (2025); 2502VACCDD (2025); 2502VACCDM (2025) Federal Agency: Various Compliance Requirement: Subrecipient Monitoring - 2 CFR § 200.332(e) Known Questioned Costs: $0 Benefit Programs continues to not confirm that program consultants complete required subrecipient monitoring procedures and/or document their work in accordance with its subrecipient monitoring plan. Benefit Programs oversees the Medicaid, SNAP, TANF, and CCDF Cluster federal grant programs. Benefit Programs disbursed over $425 million in grant funding during fiscal year 2025 from these federal grant programs to over 260 subrecipients. In response to prior audit recommendations, Benefit Programs hired a subrecipient monitoring coordinator in fiscal year 2025 and began creating new materials for managing risk assessments and monitoring reviews, including developing a memorandum detailing the schedule and operations for monitoring activities. However, due to the extent of its corrective actions, Benefit Programs did not complete its corrective actions by the end of fiscal year 2025. As a result, Benefit Programs did not identify incomplete sampling documentation, missing monitoring records, untimely locality notifications, incomplete monitoring reports, or insufficient documentation of corrective actions across multiple locality reviews. While reviewing fiscal year 2025 monitoring activities, we noted the following deviations from Benefit Programs’ subrecipient monitoring plan: Benefit Programs did not confirm that program consultants uploaded all required monitoring records to the data repository. As a result, Benefit Programs could not provide complete documentation for six out of 20 locality reviews (30%). Benefit Programs did not confirm that program consultants maintained complete sampling documents and final locality review reports for five out of 20 locality reviews (25%). Benefit Programs did not confirm that program consultants fully documented corrective actions for five out of 20 locality reviews (25%). Benefit Programs did not confirm that program consultants selected and documented sampling units appropriately. As a result, three out of 20 locality reviews (15%) lacked sufficient documentation of sampling units, and one out of 20 reviews (5%) did not include the required number of sampled cases. Benefit Programs did not confirm that program consultants included all required elements in their final monitoring review reports in two out of the 20 locality reviews (10%). Benefit Programs did not confirm that program consultants provided timely notification to localities for the monitoring review for one out of 20 locality reviews (5%). Title 2 CFR § 200.332(e) requires pass-through entities to monitor subrecipients use of subawards for authorized purposes in compliance with federal statutes, regulations, and the terms and conditions of the award. Benefit Programs’ subrecipient monitoring plan outlines the required monitoring steps, documentation standards, and timelines necessary to comply with this regulation. Without confirming that program consultants complete monitoring activities in accordance with its monitoring plan, Benefit Programs cannot provide reasonable assurance that it complied with federal monitoring requirements. These deficiencies can increase the risk of undetected noncompliance, disallowed expenditures, and potential suspension or termination of federal awards. Benefit Programs should continue to implement its planned corrective actions to confirm that program consultants conduct subrecipient monitoring activities in accordance with its monitoring plan. Views of Responsible Officials: The views of responsible officials are included in the report related to their organization, which can be found at www.apa.virginia.gov and, in summary, do not express disagreement with the finding.
2025-001 - Material Weakness in Internal Control and Material Compliance over Subrecipient Monitoring: Incomplete Subaward Agreements Identification of federal programs: Federal Agency: Department of Commerce (DOI) ALN: 11.438 – Pacific Coast Salmon Recovery Pacific Salmon Treaty Program Award Numbers: NA22NMF4380226, NA20NMF4380258, and NA21NMF4380467 Criteria: Per 2 CFR 200.332(a), pass-through entities must provide specific information to subrecipients at the time of the subaward, including but not limited to: Subrecipient name, UEI, and contact information Federal Award Identification Number (FAIN) Federal award date Period of performance CFDA/ALN number and program name Total amount of federal funds obligated All requirements imposed by the pass-through entity Indirect cost rate information Provisions for closeout Failure to include the required information limits the subrecipient’s ability to comply with federal requirements. Condition: During our testing of subrecipient monitoring, we noted that the subawards were missing elements under 2 CFR 200.332(a), including the assistance listing number and amount of federal funds obligated. Further, these relevant compliance requirements were not communicated to the subrecipients at any other time in writing. The entity made subaward payments totaling $784,907 during the audit period without maintaining complete documentation demonstrating compliance with federal subaward requirements. Cause: Pass through funding through subawards was new for the Organization and they were not familiar with subrecipient disclosure requirements. Effect or potential effect: Failure to issue complete subaward agreements increases the likelihood that subrecipients may not comply with federal requirements. These deficiencies represent a material weakness because they indicate a reasonable possibility that material noncompliance with federal requirements could occur and not be prevented or detected. Questioned Costs: None. Context: There were seven subrecipients under the program. In 2025, subrecipient expenditures totaled $784,907. Identification of Repeat Finding: Not applicable. Recommendations: Management should implement a standardized subaward agreement template that incorporates all elements required by 2 CFR 200.332(a). Views of Responsible Officials: See Corrective Action Plan.
2025-002 Material Weakness in Internal Control and Material Compliance over Subrecipient Monitoring: Failure to Verify Single Audit Requirement and Follow Up on Findings Identification of federal programs: Federal Agency: Department of Commerce (DOI) ALN: 11.438 Pacific Coast Salmon Recovery Pacific Salmon Treaty Program Awards: NA22NMF4380226, NA20NMF4380258, and NA21NMF4380467 Criteria: The entity did not verify whether subrecipients who expended $750,000 or more in federal funds obtained the required single audit. Additionally, the entity did not document any follow-up or management decisions on potential subrecipient audit findings. Under 2 CFR 200.332(f)–(g), pass-through entities must: Verify that subrecipients expending $750,000 or more in federal awards during the fiscal year have obtained a single audit in accordance with Subpart F. Review subrecipient audits to determine whether findings related to the program exist. Issue management decisions on audit findings, when applicable, and ensure timely corrective action. Condition: During our testing of subrecipient monitoring, we identified significant deficiencies in the entity’s processes for determining whether subrecipients were required to obtain a Single Audit and for following up on known audit findings: The entity did not document whether the subrecipient spent $750,000 or more in federal awards and therefore did not determine whether a Single Audit was required under 2 CFR 200.501(a). One subrecipients had publicly available Single Audit reports that included material weaknesses, yet the entity did not obtain the audit reports, review them, or follow up on corrective action plans. No documentation was maintained to demonstrate that the entity performed annual verification of audit status, reviewed the Federal Audit Clearinghouse, or communicated with subrecipients regarding audit results. Recommendations: We recommend the entity develop and implement written procedures to: Annually assess subrecipient federal expenditures to determine single audit requirements, obtain and review subrecipient audit reports, including follow-up on any findings, document management decisions and track corrective action until resolution. Views of Responsible Officials: See Corrective Action Plan. Cause: The entity lacks formal policies and procedures for monitoring subrecipients in conformance with Uniform Guidance, including annual confirmation of federal expenditures and review of audit reports. Effect or potential effect: Failure to verify audit requirements and follow up on findings limits the entity’s ability to ensure subrecipients comply with federal regulations. This increases the risk of unaddressed noncompliance, misuse of federal funds, and potential liability for the pass-through entity. Questioned Costs: None. Context: There were seven subrecipients under the program of which 4 subrecipients were reviewed related to the monitoring of audit requirements. In 2025, subrecipient expenditures totaled $784,907. Identification of Repeat Finding: Not applicable.
Finding Reference 2025-004 Federal Agency: U.S. Department of Housing and Urban Development Pass-Through Agency: P.R. Department of Housing Program: Community Development Block Grant/State’s Program and Non-Entitlement Grants in Hawaii (Assistance Listing No. 14.228) Compliance Requirement: Reporting (L) Type of Finding: Significant Deficiency (SD), Instance of Noncompliance (NC) This finding is similar to prior-year finding 2023-004 and 2024-004. Statement of Condition In our reporting test, we evaluate four (4) quarterly reports and two (2) of them were not submitted and one (1) was submitted late. Additionally, two (2) quarterly reports that were submitted do not agree with the accounting records. Criteria Based on the CDBG agreements, the Municipality must submit to the Department of Housing reports on records, collections, and disbursements of Program Income on an annual and quarterly basis. Including the progress of the projects developed with the CDBG program. In addition, the Municipality will submit all the reports required by the Agency. Failure to comply with this provision will be just cause for the Department to stop the fund requisition process. § 200.332 Requirements for pass-through entities. (1) All requirements imposed by the pass-through entity on the subrecipient so that the Federal award is used in accordance with Federal statutes, regulations and the terms and conditions of the Federal award. (2) Any additional requirements that the pass-through entity imposes on the subrecipient in order for the pass-through entity to meet its own responsibility to the Federal awarding agency including identification of any required financial and performance reports. Cause of Condition The Municipality does not have the necessary personnel assigned to prepare and present reports in a timely manner. Effect of Condition The program is not in compliance with the reporting requirements as established in the contract agreement. Recommendation We recommend that the Municipality maintain constant monitoring to improve program controls. The reports must be presented as established in the agreement and guidelines of the Department of Housing. This will ensure compliance with the reporting requirements under the Community Development Block Grants/State’s Program and Non-entitlement Grant in Hawaii agreement. Questioned Cost None Prior Year Finding Yes. This finding is similar to prior-year finding 2023-004 and 2024-004. Views of Responsible Officials and Planned Corrective Action We concur with the findings. The Municipality will be implementing the following measures to address the finding related to the late filing of the quarterly reports of the CDBG Program: 1. An accountant was hired to assume direct responsibility for the preparation, review, and filing of the CDBG Program's financial and programmatic reports. 2. Technical guidance was requested and received from the Department of Housing to ensure proper preparation and compliance with applicable reporting requirements. 3. All overdue quarterly reports and corresponding reports were filed until December 2025, including the reconciliation of the requisitioned balances versus the paid balances. 4. An internal compliance calendar was established, with deadlines and administrative supervision, to ensure timely filing in future periods. Implementation Date: December 31, 2025 Responsible Person: Pedro Santiago Federal Programs Director
Federal Agency: U.S. Department of Health and Human Services Federal Program Title: • Emerging Infections Programs • Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Numbers: • 93.317 • 93.323 Award Periods: • NU50CK000649 (1/1/2024 – 12/31/2028) (93.317) • NU50CK000548 (8/1/2019 – 7/31/2024) (93.323) • NU50CK000346 (8/1/2024 – 7/31/2029) (93.323) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or Specific Requirement: Per §200.332, Requirements for pass-through entities of 2 CFR Part 200, all pass-through entities must evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. Condition: We noted during our testing the programs did not evaluate the subrecipient’s risk of noncompliance with a subaward to determine appropriate subrecipient monitoring. While the Department has improved its efforts, there are still opportunities for improvement to reasonably ensure compliance with federal laws, regulations, and program compliance requirements as well as Department policy. Questioned Costs: None Cause: The Department continues to lack established subrecipient monitoring internal controls and procedures that comply with the uniform administrative requirements. Effect: The Department was not in compliance with federal award subrecipient monitoring requirements. Continued noncompliance could result in sanctions by the federal awarding agency, including withholding future funding. Repeat Finding: Yes 2025-008 (2024-005) Subrecipient Monitoring (Significant Deficiency, Other Noncompliance) (Continued) Recommendation: The Department should establish policies and procedures to ensure monitoring activities are performed for all subawards. Agency Response: The Department acknowledges this finding and provides a corrective action plan to prevent future similar findings. The Department does not have written procedures in place to ensure subrecipient expenditures are incurred for authorized purposes in accordance with the terms and conditions of the subaward. The Department has implemented new policies and procedures to ensure subrecipient activity controls and processes are performed for all subawards. The Division Heads will monitor their program staff and grant administrators to ensure that they are monitoring grantee activities of subrecipients to ensure that subaward is used for authorized purposes, in compliance with Federal statues, regulations and terms and conditions of the subaward. The Department is working on remediation of this finding and anticipates completion before June 30, 2026. This action plan will comply with 2 CFR Part 200 Uniform Administrative Requirements, Post Federal Award Requirements and Cost Principles for Federal Award. Responsible Persons: Federal Grants Director, Chief Procurement Officer, Contract Managers, Division Finance Directors, and Grant Administrators.
Condition: During our audit we reviewed the partnership agreement with the subrecipient. We noted the Organization did not include all required information in the partnership agreement. Criteria: As described in 2 CFR § 200.332, the Organization is required to have specific information described in the agreements with subrecipients. Cause: During the year, the Organization received a grant that specifically named the subrecipient. Due to this situation, the agreement between the Organization and the subrecipient was missing required information. Effect: Due to not including all required information in the partnership agreement with the subrecipient, this caused unclear or unknown requirements in the partnership agreement. Recommendation: After thoroughly reviewing the unique circumstance that led to this audit finding, we have determined that it is highly unlikely to recur. Given the Organization's strong compliance history and familiarity with subrecipient requirements under Uniform Guidance, we do not see a cost-effective benefit to revamping internal controls specifically for this issue. Instead, we recommend continuing to; review government awards, provide refresher trainings to staff, and conduct periodic reviews of internal controls to ensure ongoing compliance. These measures will effectively address the finding without incurring unnecessary costs. Views of Responsible Officials: Management agrees with the finding.
Program: AL 84.010 – Title I Grants to Local Educational Agencies – Subrecipient Monitoring Grant Number & Year: All open, including S010A230027, FFY 2024; S010A240027, FFY 2025 Federal Grantor Agency: U.S. Department of Education Criteria: 2 CFR § 200.332 (January 1, 2024, and January 1, 2025) requires a pass-through entity to monitor the activities of subrecipients as necessary to ensure that subaward funds are used for authorized purposes in compliance with Federal regulations, track Single audit requirements and verify that a Single audit was obtained if required, review financial and performance reports of the subrecipient, and follow-up and resolve all audit finding pertaining to the Federal award. 2 CFR § 200.501 (January 1, 2024), as it applies to audit requirements of entities for fiscal years ended prior to October 1, 2025, states the following: (a) Audit required. A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part. (b) Single audit. A non-Federal entity that expends $750,000 or more during the non-Federal entity’s fiscal year in Federal awards must have a single audit conducted in accordance with § 200.514[.] Good internal control requires policies and procedures to ensure that subrecipient monitoring is sufficiently designed and performed regularly to provide assurance that grant funds are used in accordance with Federal requirements. This includes maintaining adequate documentation to support fiscal monitoring performed for Federal programs and documentation of follow-up procedures performed when subrecipients are expected to have Federal expenditures exceeding Federal audit requirement thresholds but do not receive a Federal Single audit. Condition: The Agency’s procedures can be improved to ensure that: • Subrecipients’ uses of funds were monitored to ensure compliance with all Federal and grant requirements. • Subrecipients obtain Single audits mandated by Federal requirements. Repeat Finding: No Questioned Costs: None Statistical Sample: No Context: The Agency disbursed $106,911,261 of Title I Federal funds to 242 different subrecipients during the fiscal year ended June 30, 2025. We noted the following during our subrecipient monitoring testing. Insufficient Subrecipient Fiscal Monitoring Procedures Per its fiscal monitoring procedures and schedule, the Agency is to perform fiscal monitoring of the various subrecipients on a three-year rotational cycle. These procedures include reviewing subrecipient expenditures claimed for subgrant awards applicable for the period the Agency is monitoring. We randomly selected 25 subrecipients to review the fiscal monitoring documentation provided by the Agency. We noted the following for two subrecipients: • For one subrecipient tested, the fiscal monitoring was last completed in August 2021 for the 2019–2020 program year, during which no compliance errors were noted. Per the Agency, fiscal monitoring was scheduled to be performed again in calendar year 2023 for the 2022–2023 program year; however, this monitoring was never performed. As of June 30, 2025, no fiscal monitoring review had been initiated. Additionally, during a review of reimbursement requests submitted during the fiscal year, we noted some questionable expenditures, including $3,027 spent on hotels at Disney’s Animal Kingdom in Florida, which were reportedly in association with a teaching conference held eight miles away at the Orlando World Center Marriott. The daily rate charged by the hotel was $299 per night; the Government Services Administration’s rate for lodging in Orlando for June 2024 was $140 per night. We also noted that a possible travel expenditure of $955 was paid to Holiday Express for which no support was obtained. These types of higher-risk expenditures further highlight the need for subrecipient monitoring to be performed regularly. • For another subrecipient, the Agency last completed its fiscal monitoring in August 2025 for the 2023–2024 program year. However, monitoring documentation was not sufficient to determine what monitoring procedures were completed or whether that monitoring was adequate. While we did observe various records on file, including employee time and effort logs and invoices supporting supplies and service costs, the audit worksheet that the Agency is supposed to complete for all fiscal monitoring performed did not indicate what items were reviewed or the conclusion regarding those items. We did observe an exit letter issued by the Agency in August 2025, which indicated that no issues were found. Single Audit Tracking Procedures During our review of subrecipient audits and Single audit tracking procedures implemented by the Agency, we noted that, for one subrecipient tested, the Agency had identified the subrecipient as having more than $750,000 in Federal expenditures for the subrecipient’s fiscal year ended August 31, 2024, but noted that no Single audit was required. After we inquired with the Agency, no documentation could be provided to support that the Agency performed any follow-up procedures to verify that a Single audit was not required. Cause: Inadequate procedures to ensure that subrecipients complied with all Federal and grant requirements or to ensure that subrecipients obtained Single audits when required. Effect: Without adequate monitoring and review procedures, there is an increased risk that Federal awards could be used for unallowable costs. Recommendation: We recommend the Agency strengthen procedures to ensure that subrecipient monitoring is properly designed to ensure compliance with all Federal and grant requirements and that documentation is maintained to support procedures performed. We also recommend the Agency strengthen procedures to ensure that subrecipient Single audit requirements are properly tracked, and all Single audits are reviewed in a timely manner. Management Response: NDE agrees with this finding.
Program: AL 84.365 – English Language Acquisition State Grants – Subrecipient Monitoring Grant Number & Year: All open, including S365A230027, FFY 2024; T365A240027, FFY 2025 Federal Grantor Agency: U.S. Department of Education Criteria: 2 CFR § 200.332 (January 1, 2024, and January 1, 2025) requires a pass-through entity to monitor the activities of subrecipients as necessary to ensure that subaward funds are used for authorized purposes in compliance with Federal regulations, track Single audit requirements and verify that a Single audit was obtained, if required, review financial and performance reports of the subrecipient, and follow up and resolve all audit finding pertaining to the Federal award. Good internal control requires policies and procedures to ensure that subrecipient monitoring is sufficiently designed and performed regularly to provide assurance that grant funds are used in accordance with Federal requirements. This includes maintaining adequate documentation to support fiscal monitoring performed for Federal programs, such as documenting the populations of transactions that agree or reconcile to reimbursement requests, identifying the specific transactions that are being reviewed, and maintaining supporting documentation for those specific items reviewed. Condition: The Agency lacked adequate procedures for monitoring subrecipient use of funds to ensure compliance with all Federal and grant requirements. Repeat Finding: No Questioned Costs: None Statistical Sample: No Context: The Agency disbursed $6,255,240 of Federal funds to 26 different subrecipients during the fiscal year ended June 30, 2025. We randomly selected 10 subrecipients to ensure that subrecipient monitoring was adequate to ensure that funds were used in accordance with Federal requirements. We noted issues with monitoring procedures for eight subrecipients tested. The following table identifies the eight subrecipients, the total amount of aid paid during the fiscal year ended June 30, 2025, the last school year reviewed, and the funds subject to monitoring for those years. See Schedule of Findings and Questioned Costs for chart/table. Insufficient Subrecipient Fiscal Monitoring Procedures Per the Agency’s fiscal monitoring procedures and monitoring schedule, the Agency is to perform fiscal monitoring of the various subrecipients on a three-year rotational cycle. These procedures include reviewing subrecipient expenditures claimed for subgrant awards applicable for the period the Agency is monitoring. There are two subprograms that subrecipients may be awarded Federal funds by the Agency, Immigrant Education (IE) for schools that have experienced a significant increase in number of immigrant children and youth in their schools, and English Learners (EL) for schools to use to help identified students attain English proficiency and meet challenging State academic standards. During review of fiscal monitoring documentation provided by the Agency, we noted the following: • For one subrecipient tested, the Agency could not provide documentation to support the Agency’s last completed review. The Agency did provide an engagement letter, dated November 18, 2025, indicating that it had started a new monitoring review of the subrecipient for the 2023-2024 school year; however, this was after our audit period and was not yet completed. • For seven subrecipients tested, we were unable to determine how the Agency had sampled transactions for the subrecipients’ accounting records, such as a general ledger report of transactions, supporting the expenditures for the periods being reviewed. In one instance, no such records were provided in the review documentation. In another instance, the accounting records did not agree to the period being reviewed, and there was no documentation of a reconciliation by the Agency. For the remaining five, there were appropriate accounting reports; however, there was not adequate documentation of items selected for review. Additionally, when considering the specific IE and EL subprograms for which subrecipients are awarded funds, we noted the following: o For two subrecipients, there was no documentation that amounts awarded under the IE or EL subprogram were reviewed. For one of the subrecipients, documentation was provided, but it was not clear if it was actually reviewed by the Agency. o For four subrecipients, transactions were identified as being reviewed for the IE subprogram; however, there was no supporting documentation on file that could be provided to us for verification. o For four subrecipients that received EL subprogram funds, documentation was not adequate to support amounts reviewed. For one, there was no indication of amounts reviewed. Amounts were identified for the other three, but the Agency did not have any supporting documentation for the amounts identified, or it was not clear that supporting documentation was actually reviewed. We also noted that, for one subrecipient tested, the most recent fiscal monitoring review was completed in calendar year 2021, which was over three years prior. As the Agency’s procedures indicate every subrecipient should be subject to fiscal monitoring at least once every three years, we consider this review to be untimely. Other Issues Noted During our review of one subrecipient aid payment tested, we noted that the Agency’s reimbursement request review did not obtain documentation for credit card transactions, totaling $7,118, as required by the Agency’s grant management procedures. The Agency personnel that reviewed the request had indicated they reviewed the credit card transactions; however, no documentation was obtained and on file to support the transactions in accordance with the Agency’s grant management procedures. Additionally, we noted one instance of the Agency not having documentation on file to demonstrate that it followed up on corrective actions being taken by a subrecipient for issues the Agency identified during its subrecipient monitoring. Cause: Inadequate procedures to ensure that subrecipients complied with all Federal and grant requirements. Effect: Without adequate monitoring and review procedures, there is an increased risk that Federal awards could be used for unallowable costs. Recommendation: We recommend the Agency strengthen procedures to ensure that subrecipient monitoring is properly designed to ensure compliance with all Federal and grant requirements, and documentation is maintained to support procedures performed, including maintaining documentation of follow-up performed when corrective action plans are required for problems identified during the monitoring. Management Response: NDE agrees with this finding.
Program: AL 21.027 – COVID-19 – Coronavirus State and Local Fiscal Recovery Funds – Subrecipient Monitoring Grant Number & Year: SLFRP1965, March 3, 2021, through December 31, 2024 Federal Grantor Agency: U.S. Department of the Treasury Criteria: 2 CFR § 200.332 (January 1, 2024) states, in relevant part, the following: All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal award identification. * * * * (ii) Subrecipient’s unique entity identifier; (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date . . . . * * * * (x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA); (xi) Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; (xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement; * * * * (5) A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient’s records and financial statements for the pass-through entity to fulfill its monitoring requirements; and (6) Appropriate terms and conditions concerning the closeout of the subaward. * * * * (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the passthrough entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the passthrough entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward . . . . * * * * (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient’s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in §200.501. 2 CFR § 200.318 (January 1, 2024) states, in relevant part, the following: (a) The non-Federal entity must have and use documented procurement procedures, consistent with State, local, and tribal laws and regulations and the standards of this section, for the acquisition of property or services required under a Federal award or subaward. The non-Federal entity’s documented procurement procedures must conform to the procurement standards identified in §§200.317 through 200.327. * * * * (i) The non-Federal entity must maintain records sufficient to detail the history of procurement. These records will include, but are not necessarily limited to, the following: Rationale for the method of procurement, selection of contract type, contractor selection or rejection, and the basis for the contract price. 2 CFR § 180.300 (January 1, 2024) requires that the pass-through entity take specific steps to document that subrecipients are not suspended or debarred, as outlined below: When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM.gov Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. 2 CFR § 200.430(i) (January 1, 2024) states the following in relevant part: (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: * * * * (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities (for IHE, this per the IHE’s definition of IBS); * * * * (vii) Support the distribution of the employee’s salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. (viii) Budget estimates (i.e., estimates determined before the services are performed) alone do not qualify as support for charges to Federal awards[.] Good internal controls and sound business practices require policies and procedures to ensure that adequate monitoring is performed to verify that subrecipients are using funds in accordance with all Federal and grant requirements. Condition: The State lacked procedures to ensure that: • Subrecipient use of funds was monitored to ensure compliance with all Federal and grant requirements. • Subrecipients obtained audits required by Federal requirements, and those audits were obtained and reviewed in a timely manner. Repeat Finding: No Questioned Costs: None Statistical Sample: No Context: The State paid $172,943,444 to subrecipients for 143 subawards during the fiscal year ended June 30, 2025. We selected 17 subrecipients to test. Additionally, we reviewed the single audit tracking procedures for all State agencies acting as pass-through entities. We noted the following: Insufficient Subrecipient Monitoring Procedures For 5 of 17 subawards tested, the APA noted that subrecipient monitoring was insufficient to ensure that the subrecipient complied with all Federal and grant requirements. Additionally, for one of the subawards tested, the APA noted that the pass-through entity did not have documentation on file to support it verified the subrecipient was not suspended or otherwise debarred. Deficiencies noted included the following: • One $86,650,000 subaward tested was issued by the Military Department (Military) to the University of Nebraska Board of Regents (University). During testing, the APA noted that the only monitoring performed by the Military was a review of the University’s single audit for fiscal year ended June 30, 2024. A total of $47,533,117 was paid to the University for the fiscal year ended June 30, 2025. • During our audit, we observed that for two subawards, one issued by the Department of Natural Resources (DNR) and one by the Department of Health and Human Services (DHHS), each valued at $2,000,000 for capital riverfront improvements and the construction of a youth activity center, respectively, significant disbursements were used to cover construction costs. However, neither pass-through entity could provide documentation supporting that subrecipient monitoring performed or planned included adequate procedures to ensure that the subrecipient had followed its written procurement policies, and procurement procedures were adequately documented. These subrecipients were paid $1,362,909 and $841,446, respectively, during the fiscal year ended June 30, 2025. • For one subaward tested, issued by the Department of Correctional Services (Corrections) for $1,505,826 to implement a transitional living and vocational skills program for former inmates, the APA did not observe any documentation supporting that Corrections had verified the subrecipient was not suspended or otherwise debarred from receiving Federal funds. Additionally, the APA noted that the subaward included significant costs for subrecipient payroll and benefit costs. For those salaried employees who had only a portion of their payroll coded to the grant, Corrections relied on budget estimates submitted at the beginning of the subaward to ensure the cost allocation was proper. The APA observed that six salaried employees had payroll costs coded to the grant, ranging from 2% - 98% of their total salaries. During the fiscal year ended June 30, 2025, the total paid to the subrecipient for this subaward was $204,302. • For one subaward issued by DHHS for $4,000,000 to be used towards increasing childcare license capacity, the APA noted that DHHS failed to perform the subrecipient monitoring procedures outlined in their monitoring policy. The monitoring policy for the subaward indicated that 10% of all expenses would be reviewed. DHHS claimed to have reviewed 10% of all reimbursements between July 2023 – April 2024; however, the APA observed $628,610 of reimbursed costs after April 2024, all of which was disbursed in August 2024 for which no review was performed. Additionally, the APA noted DHHS did not obtain appropriate documentation to support $387 of payroll costs coded to the grant. A total of $627,110 was paid to this subrecipient during the fiscal year ended June 30, 2025. Failure to Communicate all Required Subaward Information During our review of subrecipient monitoring, the APA noted that, for 4 of 17 subawards tested, the subaward did not contain all required information or contained erroneous information, as follows: • In two instances of subawards issued by DHHS, the subaward listed the Federal Award Identification Number (FAIN) as SLFRP3145; however, the primary CLSFRF award to the State of Nebraska was SLFRP1965, while the SLFRP3145 award merely passed through the State to various Non-Entitlement Units (NEU’s) in the State that were the primary recipients. • One subaward issued by DNR and one subaward issued by Corrections lacked required information, as noted below. Neither department could provide documentation showing that this information had otherwise been communicated to the subrecipient. See Schedule of Findings and Questioned Costs for chart/table. Single Audit Tracking Procedures During our review of single audit tracking procedures implemented by the State, we noted the following: • DNR and the Department of Labor (DOL) lacked procedures for determining if subrecipients were required to have a single audit or obtain and review such audits. DOL had 10 subrecipients who had received cumulative payments as of June 30, 2025, ranging from $1,000 to $318,669. DNR had 13 subrecipients that received cumulative payments as of June 30, 2025, ranging from $12,557 to $32,256,022. Three of DNR’s subrecipients have received payments over $750,000 as of June 30, 2025. In reviewing the Federal Audit Clearinghouse (FAC), two of these subrecipients had single audits for the subrecipients’ fiscal year 2024, which listed CSLFRF (ALN 21.027) as a major program and reported no findings. • During testing, the APA identified three instances of DHHS failing to obtain and review subrecipient single audits due to errors in that agency’s tracking procedures. The three subrecipients had received $2,209,137 in CSLFRF funds as of June 30, 2025. The APA obtained the fiscal year 2024 single audits for all three subrecipients from the FAC and noted that ALN 21.027 was listed as a major program on all three audits. None of the audits noted any program-related findings. Cause: Inadequate procedures to ensure that subrecipients complied with all Federal and grant requirements or to ensure that subrecipients obtained single audits when required. Effect: Without adequate monitoring and review procedures, there is an increased risk of Federal awards being used for unallowable costs. Recommendation: We recommend the State strengthen procedures to ensure that subrecipient monitoring is designed properly to ensure compliance with all Federal and grant requirements. We also recommend the State strengthen procedures to ensure that subrecipient single audit requirements are tracked properly, and all single audits are reviewed in a timely manner. Management Response: Military Department The Department of Military disagrees with this finding. The subrecipient submitted an independent audit on 4/1/2025. The independent auditor employed auditing standards generally accepted in the United States (GAAS). Major federal programs included COVID-19, Coronavirus State and Local Fiscal Recovery Funds, Assistance Listing Number 21.027. The independent auditor concluded there were no significant deficiencies or material weaknesses. The auditee was deemed “low risk.” In NEMA’s risk evaluation, it considers two separate University of Nebraska offices whose responsibility includes work to monitor and ensure compliance with Federal regulations. When determining risk appetite and risk tolerance, the “…cost of internal control should never exceed anticipated benefits. Thus, an entity must accept a certain level of risk.” Findings by the independent auditor and Auditor of Public Accounts exceed any benefit that might have been gained by additional subrecipient monitoring. In October 2025, the Agency formally adopted the Subrecipient Monitoring policy and procedure it has informally used the last several years. APA Response: 2 CFR § 200.332(d)(4) (January 1, 2024) requires pass-through entities to perform subrecipient monitoring, which includes obtaining and reviewing subrecipient Single Audit reports. Subsection (d)(4) of this regulation states: If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant audit agency or cognizant oversight agency to perform audit follow-up . . . . Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. Department of Natural Resources While DNR conducted general subrecipient monitoring activities, documentation did not sufficiently demonstrate that monitoring procedures included a review of subrecipient procurement practices for compliance. DNR communicated the required federal award information to the subrecipient through other means, it was not consistently incorporated into the formal subaward agreement as required. While DNR does require Single Audits per their contracts, they did not have formalized, written procedures to consistently determine whether subrecipients met the Single Audit threshold, to ensure timely receipt and review of Single Audit reports when required. The Department acknowledges that documented procedures are necessary to ensure compliance with applicable federal regulations and to strengthen subrecipient oversight. Department of Health and Human Services Agency agrees with finding. Department of Correctional Services Management agrees with the finding.
U.S. Departments and Pass-Through Programs with various assistance listings as listed in the Schedule of Expenditures for the Research and Development Cluster Subrecipient Monitoring Material Weakness in Internal Control over Compliance and Material Noncompliance Grant Award Number: Potentially affects all grant awards with pass-through payments included under the Research and Development Cluster for DRI, NSU, UNLV, and UNR on the Schedule of Expenditures of Federal Awards. Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.332 requires that: • Pass-through entities establish policies for subrecipient monitoring that have a risk-based approach to determine the appropriate monitoring. • Pass-through entities evaluate the risk of noncompliance with a subaward to determine the appropriate monitoring. • Pass-through entities ensure that every subaward includes certain information at the time of the subaward. • Pass-through entities monitor the activities of a subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. • Pass-through entities verify every subrecipient is audited as required by Uniform Guidance, issue management decisions for audit findings, as applicable, and ensure the subrecipient take timely corrective action on all audit findings, as applicable. Condition: Subrecipient monitoring policies are not documented, risk assessments were not performed, subawards were missing required information, monitoring of activities was not performed, and subrecipient audit reports were not monitored or reviewed. Cause: Adequate internal controls were not in place to ensure compliance with subrecipient monitoring requirements for the following institutions: • Desert Research Institute (DRI) • Nevada State University (NSU) • University of Nevada, Las Vegas (UNLV) • University of Nevada, Reno (UNR) Effect: Noncompliance may occur at a subrecipient and not be detected. Questioned Costs: None Nevada System of Higher Education Schedule of Findings and Questioned Costs Year Ended June 30, 2025 Context/Sampling: A nonstatistical sample of 60 subrecipients out of a population greater than 250 across the Nevada System of Higher Education was selected for testing. The following errors were noted by institution: Desert Research Institute DRI had five subrecipients selected for testing out of the sample of 60. • Risk assessment was not performed for one of the subrecipients selected for testing. The subaward period of performance had ended during the year and thus a risk assessment was not deemed necessary by DRI. • Subawards were missing required information for two of the subawards to subrecipients selected for testing. These two subawards were entered into in prior years but had current year payments. We were unable to see subsequent communication (after the initial subawards) that required information had been communicated. • Monitoring activities were not documented adequately to provide for reasonable assurance that two of the subrecipients were using the award for authorized purposes and meeting performance objectives. • Audit reports for one subrecipient were not reviewed timely to ensure a management decision letter would be issued within six months of the clearinghouse acceptance date, if required. Nevada State University NSU had one subrecipient selected for testing out of the sample of 60. • Risk assessment was not performed for the subrecipient selected for testing. University of Nevada, Las Vegas UNLV had 23 subrecipients selected for testing out of the sample of 60. • UNLV does not have written subrecipient monitoring policies. • Risk assessment was not performed for four of the subrecipients selected for testing. • Subawards were missing required information for three of the subawards to subrecipients selected for testing. • Monitoring activities were not documented adequately for 21 subrecipients to provide for reasonable assurance that the subrecipient was using the award for authorized purposes and meeting performance objectives. • Audit reports for five subrecipients were not reviewed timely to ensure a management decision letter would be issued within six months of the clearinghouse acceptance date, if required. University of Nevada, Reno UNR had 30 subrecipients selected for testing out of the sample of 60. • Subawards were missing required information for two of the subawards to subrecipients selected for testing. • Audit reports for two subrecipients were not reviewed timely to ensure a management decision letter would be issued within six months of the clearinghouse acceptance date, if required. Repeat Finding from Prior Year: Yes – prior year finding 2024-009. Recommendation: We recommend UNLV establish subrecipient monitoring policies. In addition, we recommend DRI, NSU, UNLV, and UNR enhance internal controls to ensure compliance with subrecipient monitoring requirements. Views of Responsible Officials: The University of Nevada, Las Vegas agrees with this finding. The Desert Research Institute agrees with this finding. The Nevada State University agrees with this finding. The University of Nevada, Reno agrees with this finding.
U.S. Department of Commerce Direct and Pass-through Nevadaworks as listed in the Schedule of Expenditures of Federal Awards Economic Development Cluster, 11.307 Subrecipient Monitoring Material Weakness in Internal Controls of Compliance Grant Award Number: Affects grant award 077907854 included under assistance listing 11.307 as a direct award for UNLV on the Schedule of Expenditures of Federal Awards. Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.332 requires that: • Pass-through entities establish policies for subrecipient monitoring that have a risk-based approach to determine the appropriate monitoring. • Pass-through entities verify every subrecipient is audited as required by Uniform Guidance, issue management decisions for audit findings, as applicable, and ensure the subrecipient take timely corrective action on all audit findings, as applicable. Condition: Subrecipient monitoring policies are not documented and subrecipient audit reports were not reviewed or confirmed to not be required. Cause: The University of Nevada, Las Vegas (UNLV) did not have adequate internal controls in place to ensure subrecipients obtained required single audits or confirmed they were not required to have one. Effect: Noncompliance may occur at a subrecipient and not be detected. Questioned Costs: None Context/Sampling: No sampling was used; there is only one subrecipient applicable to this program. UNLV does not have risk-based monitoring policies for its subrecipients. In addition, for the one subrecipient tested, an inquiry was performed by UNLV to receive the single audit from the subrecipient. There was no documentation available that the subrecipient ever responded to the inquiry or that UNLV concluded the inquiry with whether a single audit was required or not. Repeat Finding from Prior Year: No Recommendation: We recommend that UNLV establish subrecipient monitoring policies and enhance internal controls to ensure subrecipients obtain a required single audit or confirm they are not required to have one. Views of Responsible Officials: The University of Nevada, Las Vegas agrees with this finding.
U.S. Department of Health and Human Services Pass-through the State of Nevada as listed in the Schedule of Expenditures of Federal Awards Epidemiology and Laboratory Capacity for Infectious Diseases, 93.323 Subrecipient Monitoring Significant Deficiency in Internal Control over Compliance Grant Award Number: Affects award SG26176 included under assistance listing 93.323 for UNLV on the Schedule of Expenditures of Federal Awards. Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.332 requires that: • Pass-through entities establish policies for subrecipient monitoring that have a risk-based approach to determine the appropriate monitoring. • Pass-through entities evaluate the risk of noncompliance with a subaward to determine the appropriate monitoring. Condition: Subrecipient monitoring policies are not documented and risk assessment was not performed. Cause: The University of Nevada, Las Vegas (UNLV) did not have adequate internal controls to ensure subrecipient monitoring policies were established and to ensure risk assessments were performed. Effect: Noncompliance may occur at a subrecipient and not be detected by UNLV. Questioned Costs: None Context/Sampling: No sampling was performed, the one subrecipient applicable to the grant was tested. We noted UNLV does not have documented subrecipient monitoring policies and a risk assessment was not performed for the subrecipient. Repeat Finding from Prior Year: No Recommendation: We recommend that UNLV establish subrecipient monitoring policies and enhance internal controls to ensure risk assessments are performed. Views of Responsible Officials: The University of Nevada, Las Vegas agrees with this finding.
U.S. Department of Health and Human Services Pass-through the State of Nevada and others as listed in the Schedule of Expenditures of Federal Awards Block Grant for Community Mental Health Services, 93.958 Subrecipient Monitoring Material Weakness in Internal Control over Compliance Grant Award Number: Affects grant award SG-2025-00677, SG-2025-00820, and SG-26361 included under the under assistance listing 93.958 for UNLV on the Schedule of Expenditures of Federal Awards. Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200 Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) section 200.332 requires that: • Pass-through entities establish policies for subrecipient monitoring that have a risk-based approach to determine the appropriate monitoring. • Pass-through entities monitor the activities of a subrecipient as necessary to ensure that the subaward is used for authorized purposes, complies with the terms and conditions of the subaward, and achieves performance goals. Condition: Subrecipient monitoring policies are not documented and monitoring of activities was not performed. Cause: The University of Nevada, Las Vegas (UNLV) did not have adequate internal controls to ensure required subrecipient monitoring policies were established and perform monitoring activities. Effect: Noncompliance may occur at a subrecipient and not be detected. Questioned Costs: None Context/Sampling: The entire population of three subrecipients/subawards was selected for testing across both UNLV (one) and UNR (two). The following error was noted: University of Nevada, Las Vegas • UNLV does not have written subrecipient monitoring policies. • Monitoring activities were not documented adequately to provide for reasonable assurance that the subrecipient was using the award for authorized purposes and meeting performance objectives. Repeat Finding from Prior Year: Yes – prior year finding 2024-023. Recommendation: We recommend UNLV establish subrecipient monitoring policies and enhance internal controls to ensure subrecipients are monitored for compliance with award terms and conditions. Views of Responsible Officials: The University of Nevada, Las Vegas agrees with this finding.
Department of Aging Finding 2025 – 003: ALN 93.044, 93.045, and 93.053 – Aging Cluster (including COVID-19) A Material Weakness and Material Noncompliance Exist in the Department of Aging Related to Subrecipient Monitoring (A Similar Condition Was Noted in Prior Year Finding 2024-003) Federal Grant Number(s) and Year(s): 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PASTPH (1/01/2022 – 9/30/2025), 2301PAOACM (10/01/2022 – 9/30/2025), 2301PAOAHD (10/01/2022 – 9/30/2025), 2301PAOASS (10/01/2022 – 9/30/2025), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2501PAOASS (10/01/2024 – 9/30/2026), 2501PAOACM (10/01/2024 – 9/30/2026), 2501PAOAHD (10/01/2024 – 9/30/2026), 2501PAOANS (10/01/2024 – 9/30/2026) Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Compliance Requirement: Subrecipient Monitoring Condition: Within the Aging Cluster, the Pennsylvania Department of Aging (PDOA) contracts with 52 Area Agency on Aging subrecipients to provide various services that include cares support, preventive health, and nutrition services, among others. Our audit testing disclosed that PDOA performed subrecipient monitoring on 18 of the 52 subrecipients during the fiscal year ended June 30, 2025. The review period for the 18 subrecipients monitored was 2019 through 2023, representing old grant years. The monitoring performed did not include grants in years 2024 and 2025 to ensure timely compliance. The Aging Cluster subrecipients received $66.3 million, or 97 percent, of Aging Cluster Program expenditures totaling $68.1 million reported on the Schedule of Expenditures of Federal Awards (SEFA). Criteria: 45 CFR Section 1321.9 State agency policies and procedures, states in part: (a) The State agency on aging shall develop policies and procedures governing all aspects of programs operated as set forth in this part… The State agency is responsible for implementing, monitoring, and enforcing policies and procedures, where: (1) The policies and procedures developed by the State agency shall address how the State agency will monitor the programmatic and fiscal performance of all programs and activities initiated under this part for compliance with all requirements, and for quality and effectiveness. 2 CFR Section 200.332, Requirements for pass-through entities, states: (e) Monitor the activities of the subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. Finding 2025 – 003: (continued) (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity… (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. PDOA’s Policy and Procedures Manual, Section B. Roles and Responsibilities of the State Authority states: In accordance with the State’s administrative authority, the Department’s functions and responsibilities include the following: • The establishment and maintenance of policies and procedures for the fiscal and programmatic operation of the programs. • The establishment of minimum standards for the provision of services and benefits. • Enter into contracts or grants between the State and the Area Agencies on Aging (AAA) to set forth the responsibilities and performance requirements. • Provide oversight and monitoring of the AAAs for compliance with all program's standards. • Provide oversight and fiscal management of fund utilization based on funding source requirements. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Finding 2025 – 003: (continued) Cause: In response to the lack of monitoring procedures conducted in the prior year, PDOA has started monitoring subrecipients but continues to have a backlog. PDOA accelerated the monitoring schedule to include prior year review periods to bring the monitoring process current but did not monitor the current audit period. PDOA’s policy did not include a defined monitoring cycle of its subrecipients to ensure adequate monitoring was performed on a timely basis. We acknowledge that PDOA has implemented a new phase of their monitoring process. They enhanced the monitoring instrument used to monitor subrecipients and are working to eliminate the monitoring backlog. Effect: Without proper subrecipient monitoring, PDOA cannot ensure compliance with grant requirements and federal regulations, including allowable costs and other requirements. Recommendation: PDOA should perform adequate during-the-award monitoring procedures for all Aging Cluster subrecipients to ensure timely compliance with all applicable federal regulations. PDOA policy should include a defined monitoring cycle to ensure timely monitoring visits in addition to the compliance procedures. Monitoring by state officials should be supported by documentation to show the monitoring performed, areas examined, conclusions reached, and that the monitoring was performed in compliance with applicable regulations. Agency Response: PDOA agrees with the finding. Questioned Costs: The amount of questioned costs cannot be determined.
Department of Agriculture Department of Aging Finding 2025 – 013: ALN 10.565, 10.568, and 10.569 – Food Distribution Cluster ALN 93.044, 93.045, and 93.053 – Aging Cluster (including COVID-19) State Agencies Did Not Identify the Federal Award Information and Applicable Requirements at the Time of the Subaward and Did Not Evaluate Each Subrecipient’s Risk of Noncompliance as Required by the Uniform Grant Guidance (A Similar Condition Was Noted in Prior Year Finding 2024-014) Federal Grant Number(s) and Year(s): 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), 241PA445Q2204 (10/01/2023 – 9/30/2024), 251PA825Y8105 (10/01/2024 – 9/30/2025), 228PA100I1003 (6/13/2022 – 6/30/2025), 238PA000I1003 (5/25/2023 – 6/30/2025), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PASTPH (1/01/2022 – 9/30/2025), 2301PAOACM (10/01/2022 – 9/30/2025), 2301PAOAHD (10/01/2022 – 9/30/2025), 2301PAOASS (10/01/2022 – 9/30/2025), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2501PAOACM (10/01/2024 – 9/30/2026), 2501PAOAHD (10/01/2024 – 9/30/2026), 2501PAOANS (10/01/2024 – 9/30/2026), 2501PAOASS (10/01/2024 – 9/30/2026) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Compliance Requirement: Subrecipient Monitoring Condition: The Uniform Guidance in 2 CFR Section 200 applies to the major programs listed above for the fiscal year ended June 30, 2025. Our testing disclosed that the Pennsylvania Department of Agriculture (PDA) did not identify the federal award information in subrecipient award documents. Additionally, PDA, and the Pennsylvania Department of Aging (PDOA) did not adequately evaluate each subrecipient’s risk of noncompliance for the purpose of determining the appropriate subrecipient monitoring related to the subaward. This represents an internal control weakness which could cause subrecipients to be improperly informed of federal award information and may result in inadequate monitoring by the state agencies. Also, it could cause the omission or improper identification of program expenditures on subrecipients’ Schedules of Expenditures of Federal Awards (SEFAs). The following chart shows which federal award information required by 2 CFR Section 200 was omitted (as indicated by “No”) from the subrecipient award documents at the time of the subaward and which major programs did not have a state agency evaluation of each subrecipient’s risk of noncompliance. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Finding 2025 – 013: (continued) Criteria: 2 CFR Section 200.332, Requirements for pass-through entities, states in part: All pass-through entities must: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: (1) Federal award identification. (iii) Federal Award Identification Number (FAIN); (6) Appropriate terms and conditions concerning closeout of the subaward. (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should identify, analyze, and respond to risks related to achieving the defined objectives. Management should identify, analyze, and respond to significant changes that could impact the internal control system. Cause: In general, PDA’s (Commodity Supplemental Food Program) processes for subrecipient award monitoring did not identify the omission of required elements from the grant awards. In addition, the risk assessments performed by PDA and PDOA were not properly documented or not performed. Effect: Excluding the federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete SEFAs in their Single Audit reports submitted to the Commonwealth, and federal funds may not be properly audited at the subrecipient level in accordance with the Single Audit Act and Uniform Guidance. Not evaluating each subrecipient’s risk of noncompliance for purposes of determining the appropriate subrecipient monitoring related to the subaward may result in subrecipients using the subaward for unauthorized purposes or in violation of the terms and conditions of the subaward, and state agency monitoring would not detect this noncompliance and ensure it is corrected in a timely manner. Finding 2025 – 013: (continued) Recommendation: PDA should develop policies and reporting mechanisms to ensure all required federal award information is disseminated to all subrecipients at the time of the subaward to ensure subrecipient compliance with the Uniform Guidance in 2 CFR Section 200 and other applicable federal regulations. In addition, PDA should correspond with applicable subrecipients to ensure they are aware of the correct federal award information and review applicable subaward documents prior to issuance to ensure federal information is complete and accurate. PDA and PDOA should implement procedures to adequately document their evaluation of each subrecipient’s risk of noncompliance as cited in 2 CFR Section 200.332 for purposes of determining the appropriate subrecipient monitoring related to the subaward. PDA Response: PDA agrees with this finding. PDOA Response: PDOA agrees with this finding. Questioned Costs: The amount of questioned costs cannot be determined.
Various Agencies Finding 2025 – 014: ALN 10.565, 10.568, and 10.569 – Food Distribution Cluster ALN 66.458 – Clean Water State Revolving Fund ALN 84.425C – COVID-19 – Education Stabilization Fund – GEER Fund ALN 84.425D – COVID-19 – Education Stabilization Fund – ESSER Fund ALN 84.425R – COVID-19 – Education Stabilization Fund – CRRSA EANS Program ALN 84.425U – COVID-19 – Education Stabilization Fund – ARP ESSER ALN 84.425V – COVID-19 – Education Stabilization Fund – ARP EANS Program ALN 84.425W – COVID-19 – Education Stabilization Fund – ARP ESSER HCY ALN 93.044, 93.045, and 93.053 – Aging Cluster (including COVID-19) A Material Weakness and Material Noncompliance Exist in the Commonwealth’s Subrecipient Audit Resolution Process (A Similar Condition Was Noted in Prior Year Finding 2024-015) Federal Grant Number(s) and Year(s): 228PA100I1003 (6/13/2022 – 6/30/2025), 241PA825Y8005 (10/01/2023 – 9/30/2024), 241PA825Y8105 (10/01/2023 – 9/30/2024), 241PA445Q2204 (10/01/2023 – 9/30/2024), 238PA000I1003 (5/25/2023 – 6/30/2025), 251PA825Y8105 (10/01/2024 – 9/30/2025), 42000124-0-CS (7/01/2024 – 9/30/2026), 95324301-0-4C (7/01/2023 – 6/30/2023), 95325401-0-4X (7/01/2023 – 6/30/2030), S425W210039 (4/23/2021 – 9/30/2024), S425U210028 (3/24/2021 – 9/30/2024), S425D210028 (1/05/2021 – 9/30/2024), S425C200013 (5/18/2020 – 4/01/2024), S425R210037 (3/13/2020 – 9/30/2024), S425V210037 (11/16/2021 – 9/30/2024), S425C210013 (3/13/2020 – 9/30/2024), 2101PACMC6 (4/01/2021 – 9/30/2024), 2101PAHDC6 (4/01/2021 – 9/30/2024), 2101PASSC6 (4/01/2021 – 9/30/2024), 2201PASTPH (1/01/2022 – 9/30/2025), 2301PAOACM (10/01/2022 – 9/30/2025), 2301PAOAHD (10/01/2022 – 9/30/2025), 2301PAOASS (10/01/2022 – 9/30/2025), 2401PAOACM (10/01/2023 – 9/30/2025), 2401PAOAHD (10/01/2023 – 9/30/2025), 2401PAOANS (10/01/2023 – 9/30/2025), 2401PAOASS (10/01/2023 – 9/30/2025), 2501PAOASS (10/01/2024 – 9/30/2026), 2501PAOACM (10/01/2024 – 9/30/2026), 2501PAOAHD (10/01/2024 – 9/30/2026), 2501PAOANS (10/01/2024 – 9/30/2026) Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Compliance Requirement: Subrecipient Monitoring Condition: Under the Commonwealth of Pennsylvania's (Commonwealth) implementation of the Single Audit Act, review and resolution of subrecipient Single Audit reports is split into two stages. The Office of the Budget’s Bureau of Accounting and Financial Management (OB-BAFM) ensures the reports meet technical standards through a centralized desk review process. The various funding agencies in the Commonwealth are responsible for making a management decision on each finding within six months of the Federal Audit Clearinghouse’s (FAC) acceptance date for audits subject to Uniform Guidance and to ensure appropriate corrective action is taken by the subrecipient (except for Uniform Guidance audits under U.S. Department of Labor programs which are permitted 12 months for management decisions in accordance with 2 CFR Section 2900.21). Each Commonwealth agency is also responsible for reviewing financial information in each audit report to determine whether the audit included all pass-through funding provided by the agency to ensure pass-through funds were subject to audit. Most agencies meet this requirement by performing Schedule of Expenditures of Federal Awards (SEFA) reconciliations. The agency is also required to adjust Commonwealth records, if necessary. Our fiscal year ended June 30, 2025 audit of the Commonwealth’s process for review and resolution of subrecipient Single Audits included an evaluation of the Commonwealth’s fiscal year ended June 30, 2024 subrecipient audit universe for audits due for submission to the FAC during the fiscal year ended June 30, 2025. We also evaluated the Commonwealth’s review of 47 subrecipient audit reports with findings in major programs/clusters which were identified on the Commonwealth agencies’ tracking lists during the fiscal year ended June 30, 2025 and required management decisions by Commonwealth agencies. Finding 2025 – 014: (continued) Our testing disclosed the following audit exceptions regarding the Commonwealth agencies’ review of subrecipient audit reports: • Pennsylvania Department of Aging (PDOA): Our testing disclosed that PDOA did not have adequate procedures in place for tracking and making management decisions on findings timely. The time period for making management decisions on findings was approximately 13.4 months to over 19 months after the FAC acceptance date for four out of four audit reports with findings. For the four items selected for testing, PDOA had not completed SEFA reconciliations or performed alternative procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. • Department of Agriculture (PDA): The time period for making a management decision on findings was approximately eight months to over 15 months after the FAC acceptance date for four out of six audit reports with findings. There were also delays in PDA’s procedures to ensure the subrecipient SEFAs were accurate so that major programs were properly determined and subjected to audit. In addition, our testing disclosed that PDA subgranted federal funds of approximately $8.9 million to one subrecipient during fiscal year ended June 30, 2024, for which the Single Audit was not submitted to the FAC as of our February 2026 testing date. This was over 10 months after the March 31, 2025 due date. • Department of Education (PDE): The time period for making a management decision on findings was approximately 6.9 months to over 12 months after the FAC acceptance date for nine out of 30 audit reports with findings selected for testing. Three of the 30 audits reports were improperly classified on PDE’s audit tracking list as not having federal award findings. There were additional audit reports with findings listed on PDE’s audit tracking list where management decisions were not made timely. • Pennsylvania Infrastructure Investment Authority (PENNVEST): The time period for making a management decision on findings was over 15.9 months after the FAC acceptance date for one out of three audit reports with findings. For one out of three items selected for testing, PENNVEST had started but had not yet completed reconciling the SEFA to ensure the subrecipient SEFA was accurate so that major programs were properly determined and subject to audit. Criteria: 2 CFR Section 200.332, Requirements for pass-through entities, states in part: A pass-through entity must: (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by §200.521 [Management decision]. (g) Verify that a subrecipient is audited as required by Subpart F [Audit Requirements] of this part. (h) Consider whether the results of a subrecipient’s audit, site visits, or other monitoring necessitate adjustments to the pass-through entity’s records. Finding 2025 – 014: (continued) (i) Consider taking enforcement action against noncompliant subrecipients as described in §200.339 [Remedies for noncompliance] and in program regulations. In order to carry out these responsibilities properly, good internal control dictates that state pass-through agencies ensure subrecipient Single Audit SEFAs are representative of state payment records each year, and that the related federal programs have been properly subjected to Single Audit procedures. 2 CFR Section 200.512, Report submission, states in part: (a) General. (1) The audit, the data collection form, and the reporting package must be submitted within 30 calendar days after the auditee receives the auditor's report(s) or nine months after the end of the audit period (whichever is earlier). The cognizant agency for audit or oversight agency for audit (in the absence of a cognizant agency for audit) may authorize an extension when the nine-month timeframe would place an undue burden on the auditee. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day. 2 CFR Section 200.521, Management decision, states in part: (a) General. The management decision must clearly state whether or not the finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments or take other action. (d) Time requirements. The Federal agency or pass-through entity responsible for issuing a management decision must do so within six months of the FAC’s acceptance of the audit report. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. 2 CFR Section 200.505, Remedies for audit noncompliance, states: In cases of continued inability or unwillingness of a non-federal entity to have an audit conducted in accordance with this part, Federal agencies or pass-through entities must take appropriate action as provided in §200.339 [Remedies for noncompliance]. 2 CFR Section 200.339, Remedies for noncompliance, states in part: The Federal agency or pass-through entity may implement specific conditions if the recipient or subrecipient fails to comply with the U.S. Constitution, Federal statutes, regulations, or terms and conditions of the Federal award. See §200.208 for additional information on specific conditions. When the Federal agency or pass-through entity determines that noncompliance cannot be remedied by imposing specific conditions, the Federal agency or pass-through entity may take one or more of the following actions: (a) Temporarily withhold payments until the recipient or subrecipient takes corrective action. (b) Disallow costs for all or part of the activity associated with the noncompliance of the recipient or subrecipient. (c) Suspend or terminate the Federal award in part or in its entirety. (d) Initiate suspension or debarment proceedings as authorized in 2 CFR Part 180 and the Federal agency’s regulations, or for pass-through entities, recommend suspension or debarment proceedings be initiated by the Federal agency. (e) Withhold further Federal funds (new awards or continuation funding) for the project or program. (f) Pursue other legally available remedies. Finding 2025 – 014: (continued) To ensure Commonwealth enforcement of federal regulations for subrecipient noncompliance with audit requirements, Commonwealth Management Directive 325.08, Amended – Remedies for Recipient Noncompliance with Audit Requirements, Section 5 related to policy, states in part: (a) Agencies must develop and implement remedial action that reflects the unique requirements of each program… (b) The remedial action should be implemented within six months from the date the first remedial action is initiated. At the end of the six-month period, the recipient should take the appropriate corrective action or the final stage of remedial action should be imposed on the recipient. Examples of remedial action include, but are not limited to: (1) Meeting or calling the recipient to explain the importance and benefits of the audit and audit resolution processes, emphasizing the value of the audit as an administrative tool and the Commonwealth’s reliance on an acceptable audit and prompt resolution as evidence of the recipient’s ability to properly administer the program. (2) Encouraging the entity to establish an audit committee or designate an individual as the single point of contact to: (a) Communicate regarding the audit. (b) Arrange for and oversee the audit. (c) Direct and monitor audit resolution. (3) Providing technical assistance to the recipient in devising and implementing an appropriate plan to remedy the noncompliance. (4) Withholding a portion of assistance payments until the noncompliance is resolved. (5) Withholding or disallowing overhead costs until the noncompliance is resolved. (6) Suspending the assistance agreement until the noncompliance is resolved. (7) Terminating the assistance agreement with the recipient and, if necessary, seeking alternative entities to administer the program. Management Directive 325.09, Amended – Processing Subrecipient Single Audits of Federal Pass-Through Funds, Section 7 related to procedures, states in part: a. Agencies. (2) Evaluate single audit report submissions received from BAFM to determine program purpose acceptability by verifying, at a minimum, that all agency-funded programs are properly included on the applicable financial schedules; that findings affecting the agency contain sufficient information to facilitate a management decision; and that the subrecipient has submitted an adequate corrective action plan. (5) Issue management decisions relative to audit findings and crosscutting findings assigned to the agency for resolution, as required by 2 CFR §200.521. If responsible for the resolution of crosscutting findings, notify the affected agency or agencies upon resolution of such findings. (7) Impose or coordinate the imposition of remedial action in accordance with 2 CFR Part 200.339 and Management Directive 325.08 Amended, Remedies for Recipient Noncompliance with Audit Requirements, when subrecipients fail to comply with the provisions of Subpart F. Finding 2025 – 014: (continued) Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s, Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: One reason provided by Commonwealth management for untimely audit resolution in the various agencies, including making management decisions, approving corrective action, and performing procedures to ensure the accuracy of subrecipient SEFAs, was either a change in staff or a lack of staff to follow up and process subrecipient audit reports more timely. Regarding the late and outstanding audit report submission, PDA did not take timely remedial action steps in accordance with 2 CFR Section 200.339 and Commonwealth Management Directive 325.08 in order to ensure compliance with federal audit submission requirements. Effect: Since required management decisions were not made within six months to ensure appropriate corrective action was taken on audits received from subrecipients, the Commonwealth did not comply with federal regulations, and subrecipients were not made aware of acceptance or rejection of corrective action plans in a timely manner. Further, noncompliance may recur in future periods if control deficiencies are not corrected on a timely basis, and there is an increased risk of unallowable charges being made to federal programs if corrective action and recovery of questioned costs is not timely. Regarding the SEFA reviews or alternate procedures which are not being performed timely, there is an increased risk that subrecipients could be misspending and/or inappropriately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by agency personnel on a timely basis as required. Finally, additional federal pass-through funds may be unaudited in the future without timely and effective remedial action from Commonwealth agencies to enforce compliance. Recommendation: We recommend that the above weaknesses that cause untimely subrecipient Single Audit resolution, including untimely management decisions on findings, and untimely review of the SEFA or alternate procedures be corrected to ensure compliance with federal requirements and Commonwealth Management Directives, and to better ensure timelier subrecipient compliance with program requirements. Commonwealth agencies should promptly pursue outstanding audits and implement remedial action steps on a timely basis in accordance with 2 CFR Section 200.339 and Commonwealth Management Directive 325.08. PDA Response: PDA agrees with the finding. PDOA Response: PDOA agrees with the finding. PDE Response: PDE agrees with the finding. PENNVEST Response: PENNVEST agrees with the finding. Questioned Costs: The amount of questioned costs cannot be determined.
Department of Labor and Industry Finding 2025 – 009: ALN 93.558 – Temporary Assistance for Needy Families Department of Labor and Industry Did Not Perform Adequate Monitoring of Temporary Assistance for Needy Families Subrecipients (A Similar Condition Was Noted in Prior Year Finding 2024-009) Federal Grant Number(s) and Year(s): 2401PATANF (10/01/2023 – 9/30/2024), 2301PATANF (10/01/2022 – 9/30/2023), 2201PATANF (10/01/2021 – 9/30/2022), 2101PATANF (10/01/2020 – 9/30/2021) Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Compliance Requirement: Subrecipient Monitoring Condition: During the fiscal year ended June 30, 2025, the Department of Labor and Industry (L&I) paid $26.9 million in Temporary Assistance for Needy Families (TANF) funding to 22 subrecipients within the Youth Employment and Training (E&T) appropriation (or 6.7 percent) out of total federal TANF expenditures of $403.4 million reported on the June 30, 2025 Schedule of Expenditures of Federal Awards (SEFA). Our testing of L&I’s during-the-award monitoring of subrecipients for the fiscal year ended June 30, 2025, disclosed that L&I did not conduct on-site monitoring or perform desk reviews of the TANF Youth Development Program (TANF YDP) for three out of five subrecipients selected for testing. Although L&I performed monitoring of these subrecipients specific to another federal program, the monitoring did not include a review of the performance of the subrecipients’ TANF YDP programs. The TANF YDP operations transitioned from the Bureau of Workforce Development Administration (BWDA) to the Bureau of Workforce Partnership and Operations (BWPO) in December 2023. During the fiscal year ended June 30, 2025, BWPO began onsite monitoring of the TANF YDP program on a limited basis by developing a pilot program that BWPO used to monitor the TANF YDP program for three subrecipients. BWPO developed a written TANF YDP Monitoring Plan that outlines plans to expand the monitoring to other TANF YDP subrecipients; however, the plan was not fully implemented as of June 30, 2025. Criteria: 2 CFR Section 200.332, Requirements for pass-through entities, states: A pass-through entity must: (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. Finding 2025 – 009: (continued) (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient’s cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in §200.425. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: L&I recognized the need to perform during-the-award monitoring procedures for TANF funds passed through for the Youth E&T program, but the updated monitoring procedures were not fully incorporated during the fiscal year ended June 30, 2025. Effect: TANF subrecipients could be operating in noncompliance with federal regulations without timely detection and correction by L&I management. Recommendation: L&I should continue to strengthen controls to ensure during-the-award monitoring is being performed for all TANF subrecipients and that the monitoring includes procedures to ensure that subrecipients are in compliance with applicable federal regulations. This should include examining subrecipients’ financial records and ensuring that all required Single Audits were obtained by L&I subrecipients. Agency Response: L&I agrees with this finding. TANF YDP operations transitioned from BWDA to BWPO in January 2023. Due to this transition, BWPO did not conduct on site monitoring of the TANF YDP program in Program Year (PY) 22. BWPO did begin monitoring in PY 23 on a limited basis as a pilot with 3 local areas in September of 2024. BWPO expanded monitoring efforts in 2025 by conducting PY 24 TANF YDP monitoring in alignment with the WIOA Common Measures Data Validation cycle. This enhanced desk review monitoring effort concluded by January 2026. PY is defined as July 1st to June 30th. BWPO will further expand annual monitoring of TANF YDP in alignment with the requirement to monitor all TANF YDP grant subrecipients for PY 25 and moving forward. L&I does ensure single audits are obtained from the TANF YDP sub-recipients as a part of our single audit review. Finding 2025 – 009: (continued) Questioned Costs: The amount of questioned costs cannot be determined.
Department of Human Services Finding 2025 – 008: ALN 93.667 – Social Services Block Grant A Material Weakness and Material Noncompliance Exist in the Department of Human Services’ Program Monitoring of the Social Services Block Grant Subrecipients (A Similar Condition Was Noted in Prior Year Finding 2024-008) Federal Grant Number(s) and Year(s): 2501PASOSR (10/01/2024 – 9/30/2026), 2401PASOSR (10/01/2023 – 9/30/2025) Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Compliance Requirements: Cash Management, Subrecipient Monitoring Condition: Our examination of the Department of Human Services’ (DHS) procedures for monitoring Social Services Block Grant (SSBG) subrecipients revealed that DHS did not adequately risk assess and monitor the SSBG Mental Health, Homeless Assistance, and Child Welfare subrecipients to ensure that SSBG awards are used in compliance with laws and regulations, which include allowable costs, period of performance, and other requirements. Although DHS performed risk assessments of these subrecipients, the risk assessments did not include a consideration of all of the items outlined in 2 CFR Section 200.332 (c) (1)-(4). Further, the risk assessments did not define the course of action to be taken for each assigned risk level. DHS program personnel indicated that they performed on-site monitoring of eight subrecipients with seven final monitoring reports issued and one report in progress. The remaining 67 subrecipients were not monitored during the audit period. Expenditures for Mental Health, Homeless Assistance, and Child Welfare subrecipient programs not monitored totaled $21.7 million (or approximately 23.2 percent) of total SSBG program expenditures of $93.6 million reported on the Schedule of Expenditures of Federal Awards (SEFA). While we noted that DHS monitored eight of the 75 Mental Health County/County Joinder subrecipients which included Mental Health, Homeless Assistance and Child Welfare services, this coverage was not adequate. In addition, our review of the risk assessments completed for all of the aforementioned subrecipients identified several instances where subrecipient monitoring was warranted but was not conducted, including several subrecipients assessed as high risk for which no monitoring procedures were performed. In addition, for the compliance requirement related to cash management, we noted that DHS advanced funds to SSBG subrecipients in four of nine program areas, representing $34.0 million (or approximately 36.3 percent) of SSBG program expenditures, without adequately monitoring the reasonableness of the subrecipient cash balances. In particular, for the program areas related to Mental Health, Intellectual Disabilities, Homeless Assistance, and Child Welfare, DHS advanced funds to subrecipients on a quarterly basis. Our inquiries with applicable DHS program administrators disclosed that DHS did not adequately monitor the four program areas’ subrecipients for cash management compliance either at the time of payment or at any other time during the fiscal year ended June 30, 2025. Furthermore, while Single Audits of SSBG subrecipients may be conducted each year, this auditing activity does not compensate for the lack of during-the-award program monitoring, since the timing, focus, and scope of subrecipient auditing activities after year end are different than compliance monitoring to be performed by program officials during the year. Criteria: 2 CFR Section 200.332, Requirements for pass-through entities, states: (c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following: Finding 2025 – 008: (continued) (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency). (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward. However, the pass-through entity is not responsible for resolving cross-cutting audit findings that apply to the subaward and other Federal awards or subawards. If a subrecipient has a current Single Audit report and has not been excluded from receiving Federal funding (meaning, has not been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant agency for audit or oversight agency for audit to perform audit follow-up and make management decisions related to cross-cutting audit findings in accordance with section § 200.513(a)(4)(viii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (f) Depending upon the pass-through entity's assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing site visits to review the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Finding 2025 – 008: (continued) 2 CFR Section 200.305 (b)(1), applicable for recipients and subrecipients, states in part: …Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. Management Directive 325.12, Amended – Standards for Enterprise Risk Management in Commonwealth Agencies, adopted the internal control framework outlined in the United States Government Accountability Office’s Standards for Internal Control in the Federal Government (Green Book). The Green Book states in part: Management should establish and operate monitoring activities to monitor the internal control system and evaluate the results. Management should remediate identified internal control deficiencies on a timely basis. Cause: DHS management indicated that risk assessment and monitoring documents were created for use during on-site monitoring of SSBG subrecipients. However, due to staffing issues, on-site monitoring was not performed for all SSBG subrecipients. Consistent with prior year audits, DHS management noted that there have been no changes to the payment methodology for the Homeless Assistance, Mental Health, Intellectual Disabilities, and Child Welfare components of SSBG. These programs provide subrecipients with advances to comply with Commonwealth law and also to ensure that adequate funds are available to provide services to participants on a timely basis. DHS officials believe that their in-house payment review procedures for the SSBG program are as efficient as administratively feasible and that controls exist in each of the program areas. Without on-site program monitoring visits by funding agency officials, we consider DHS’s limited in-house reviews of subrecipient status reports or other documents to be insufficient to detect potential subrecipient noncompliance, including excess cash violations. DHS does not adjust payments to the subrecipients based on in-house reviews. Effect: Since DHS does not adequately perform during-the-award monitoring of subrecipients, including the monitoring of subrecipient cash on hand, subrecipients may not be complying with applicable grant requirements and federal regulations, including cash management standards. Recommendation: DHS should perform risk based during-the-award monitoring procedures for all SSBG subrecipients to ensure timely compliance with all applicable federal regulations. On-site monitoring visits by state officials should be supported by documentation to show the monitoring performed, areas examined, conclusions reached, and that the monitoring was performed in compliance with applicable regulations. As recommended in previous Single Audits and supported by the United States Department of Health and Human Services, DHS should either consider changing their current subrecipient payment procedures from advancement basis to reimbursement basis or establish procedures to adequately monitor subrecipient cash on hand to ensure it is limited to immediate needs, but no longer than one month. The implementation and strengthening of these controls should provide DHS with reasonable assurance as to compliance with cash management requirements at the subrecipient level. Agency Response: DHS agrees with this finding. Questioned Costs: The amount of questioned costs cannot be determined.
Finding Reference Number: 2025-003 Name of Federal Agency: U.S. Department of Treasury Name of Pass-through Entity: Howard County Government Program Title: Coronavirus State and Local Fiscal Recovery Fund Federal Award No.: 02-11-0-D000-0237 Assistance Listing Number: 21.027 Federal Award Year: 2024-2025 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria: A pass-through entity (PTE) must Identify the Award and Applicable Requirements – Clearly identify to the subrecipient: (1) the award as a subaward at the time of subaward (or subsequent subaward modification) by providing the information described in 2 CFR 200.332(a)(1); (2) all requirements imposed by the PTE on the subrecipient so that the federal award is used in accordance with federal statutes, regulations, and the terms and conditions of the award (2 CFR 200.332(a)(2)); and (3) any additional requirements that the PTE imposes on the subrecipient in order for the PTE to meet its own responsibility for the federal award (e.g., financial, performance, and special reports) (2 CFR 200.332(a)(3)). Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our fiscal year 2025 compliance audit, we noted that the Authority awarded all twenty-seven (27) subawards without referring to federal statutes, regulations, and the terms and conditions of the award as described in 2 CFR 200.332(a)(1), 2 CFR 200.332(a)(2), and 2 CFR 200.332(a)(3). Context: The Authority awarded twenty-seven (27) subawards during fiscal year 2025 totaling $1,000,000, which represents over 99% of the total federal expenditures during fiscal year 2025. Cause: The Authority did not have adequate controls to review subaward agreements to ensure all compliance requirements are captured, that information is consistent between pass-through entity records and the subaward, and that all required elements are included. Effect: As a result of not including the proper information in the subaward agreements, the subrecipients may not be able to comply with the terms of the grant agreement and 2 CFR part 200. Identification as a Repeat Finding, if Applicable: No. Questioned Costs: None identified.Recommendation: We recommend the Authority evaluate its policies and procedures to ensure that subaward agreements include all required information as described in 2 CFR 200.332(a)(1), 2 CFR 200.332(a)(2), and 2 CFR 200.332(a)(3). Responsible Official: Controller Views of Responsible Official and Planned Corrective Action: Management concurs with the audit finding. See the accompanying management’s corrective action plan for planned corrective action.
Questioned Cost $ – Finding No. 2025-003: Subrecipient Monitoring (Material Weakness) Federal Agency: U.S. Department of Commerce AL Number and Title: 11.029 – TBCP Award Number and Award Year: NT23TBC0290054 2024 Repeat Finding? No Condition During our audit, we examined a non-statistical sample of one subaward and noted the following instances of noncompliance: - Subaward agreements did not include certain required federal award information. - A risk assessment was not performed for the subrecipient prior to execution of the subaward agreement. - No evidence of pass-through entity verifying that subrecipients are audited. Criteria 2 CFR Section 200.332(b) requires subawards to clearly identify information, such as Federal Award Identification Number, identification of whether the award is for research and development, period of performance, and indirect costs. 2 CFR Section 200.332(c) requires the pass-though entity to evaluate each subrecipient’s risk of noncompliance to determine the appropriate level of monitoring. 2 CFR Section 200.332(g) requires a pass-through entity to verify that every subrecipient is audited as required by 2 CFR Section 200, Subpart F, when it is expected that the subrecipient’s expenditures exceed applicable thresholds. Effect By not including the required information in the subaward, not performing the risk assessment, and verifying whether the subrecipient is audited, the Department may not be providing the appropriate level of monitoring over its subrecipients and represents noncompliance with 2 CFR Section 200.332. Cause and View of Responsible Officials Program personnel indicated that subaward information was provided and verification of audit was performed. However, no formal documentation was retained and no risk assessment was performed. Recommendation We recommend that program management retain evidence of the process, including who performed the procedure and the date performed, perform risk assessments, and provide the required federal award information to subrecipients.
Criteria: 2 CFR 200.332(b)(1) requires every subaward to include required information and is clearly identified. Condition/Context: Review of the agreements with three subrecipients identified certain communications required were not included in the language of the agreement. Cause: The Center was not aware of the information that is required to be included in the subaward agreement. Effect: The Center was not in compliance with 2 CFR 200.332(b)(1). Questioned Costs: None Repeat finding: Repeat of prior year finding 2024-004. Recommendation: Management should review and refine its subaward agreements to include the necessary information as required by 2 CFR 200.332(b)(1). Views of Responsible Officials: Management agrees with the finding; see corrective action plan.
Federal program: AL 21.027, COVID-19 Coronavirus State and Local Fiscal Recovery Funds; Federal agency: U.S. Department of Treasury; Award year: 2025; Criteria: Per the 2025 Office of Management and Budget (OMB) Compliance Supplement, part 4, requirement M, Subrecipient Monitoring, pass-through entities are required to perform monitoring of their subrecipients. This is further described in Uniform Guidance 2 CFR 200.332 which states "A pass-through entity must...(e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The passthrough entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports, (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the passthrough entity with information on their plan for corrective action and any assistance needed to resolve the situation. (3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the passthrough entity as required by § 200.521. (4) Resolve audit findings specifically related to the subaward...".; Condition: Evidence was not retained of monitoring subrecipients’ financial and single audit reporting or of any follow up actions as a result of monitoring.; Cause: The cause appears to be attributable to a lack of consistently applied procedures for retention of data files supporting the performance of subrecipient monitoring. If the review was performed, it was retained within the employee’s emails and not through use of an ARPA/SLFRF shared folder. The employee performing the review is no longer with the County and the review documentation could not be located. It is undeterminable if this monitoring was performed.; Effect or potential effect: Without adequate review of the subrecipient’s financial and single audit reporting related to program expenditures incurred, the control environment, compliance with laws, regulations, and program requirements, errors or misappropriation of assets could exist without the County's knowledge.; Questioned costs: No known or estimated questioned costs identified.; Context: Out of a population of 14 subrecipients, six were selected for testing for which no evidence was retained indicating the County’s review of financial and single audit reporting of the subrecipients.; Repeat finding: No.; Recommendation: The County should develop and implement policies and procedures to ensure that all subrecipient monitoring is performed and retained.; Views of responsible officials: The County understands and concurs with the finding.
Criteria or specific requirement: Per 2 CFR 200.332, all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information listed in 2 CFR 200.332(a)(1) at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR 200.332(b), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required award information. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used. Per 2 CFR 200.303, non-federal entities receiving federal awards are required to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing of subrecipient monitoring, we noted that for certain subawards the Kansas Division of Emergency Management (KDEM) did not timely issue the subaward letter to the subrecipients, which should have been communicated within 30 days of subaward being obligated or before subaward payments were made. Questioned costs: None. Context: For eleven of twenty-eight subrecipients selected for testing, KDEM did not issue subaward letters to the subrecipient timely when the funds were approved and obligated. Further for six of the eleven subrecipients tested, KDEM did not maintain documentation from a previously utilized portal that they no longer have access to. Cause: 2 CFR 200.332(a) requires subawards to include certain required information to be communicated to subrecipients at the time of the subaward being awarded. The subawards were made prior to KDEM fully implementing their corrective action plan. For six of the transactions, KDEM no longer has access to the portal in which the subaward documentation is maintained. Effect: Failure to issue subawards timely and to include required federal award information could result in subrecipients not properly administering the federal program in accordance with federal regulations. Repeat Finding: Yes, Finding 2024-011. Recommendation: We recommend that KDEM continues to implement its corrective action plan from prior year and continue to enhance its internal controls and procedures to ensure that the subaward letter is issued to subrecipients timely to ensure all required federal award information is communicated to the subrecipient at the time of the subaward. Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR 200.332, all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information listed in 2 CFR 200.332(a)(1) at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used). Per 2 CFR 200.303, non-federal entities receiving federal awards are required to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Per 2 CFR 200.332(f) pass-through entities must verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Per 2 CFR 200.332(e)(2), a pass-through entity must following-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. Single Audit findings referenced above are those resulting from audits required under 2 CFR 200.501. Condition: Subawards issued by the Kansas Department of Health and Environment (Department) did not include all required subaward information and failed to obtain the Unique Identity ID for all subawards. The Department did not obtain the required audit information (Single Audit or another applicable audit) from its subrecipient during the audit period. Questioned costs: None. Context: Twenty-five of thirty-four subawards selected for testing, totaling $11,685,599, did not include all required federal award information. Specifically, the following was omitted: • Subrecipient’s Unique Identifier - (Twenty-five of Thirty-four subawards) • Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation – (Twenty-five of thirty-four subawards) • Identification of whether the award is research and development - (Twenty-five of Thirty-four subawards) • Indirect cost rate for federal award - (twenty-five of Thirty-four subawards) For two of the thirty-four subawards the Department failed to provide evidence that the Unique Entity ID was obtained. We were not provided with an audit report for one of the thirty-four subawards tested, totaling $680,010. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required federal award information and obtain the required Unique Entity ID. Internal controls did not prevent or detect the errors. The Department did not have adequate procedures in place, or did not consistently implement existing procedures, to request, obtain, and track required subrecipient audit reports as part of its subrecipient monitoring process. Effect: Excluding the required federal award information at the time of subaward issuance could result in subrecipients not properly administering the federal programs in accordance with federal regulations. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports when all federal award information is not provided to them. Failure to obtain the subrecipient’s UEI resulted in incomplete subaward identification and increases the risk of ineffective subrecipient monitoring. Without obtaining and reviewing the subrecipient’s audit, the Department lacked reasonable assurance that audit findings, questioned costs, or instances of noncompliance affecting the subaward were identified and addressed. This increased the risk that Federal funds were not administered in accordance with applicable requirements. Repeat Finding: Yes, finding 2024-006. Recommendation: We recommend that the Department revise the subaward templates to include all required federal award information and update its procedures and internal controls to ensure that all required federal award information is included in subawards at the time of issuance. The Department should establish and implement formal subrecipient monitoring procedures to ensure required audit reports are requested, obtained, and reviewed in a timely manner. The Department should document its review of audit results and perform appropriate follow‑up on any identified deficiencies to ensure compliance with Federal requirements. Views of responsible officials: There is no disagreement with the audit finding.
Criteria or specific requirement: Per 2 CFR 200.332, all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information listed in 2 CFR 200.332(a)(1) at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Per 2 CFR 200.332(b), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes required award information. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes: Subrecipient's name, Subrecipient's unique entity identifier, Federal Award Identification Number (FAIN), Federal Award Date, Subaward Period of Performance Start and End Date, Subaward Budget Period Start and End Date, Amount of Federal Funds Obligated in the subaward, Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation, Total Amount of the Federal Award committed to the subrecipient by the pass-through entity, Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA), Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity, Assistance Listings title and number, Identification of whether the Federal award is for research and development, Indirect cost rate for the Federal award (including if the de minimis rate is used. Per 2 CFR 200.332(a), a pass-through entity must verify that the subrecipient is not excluded or disqualified in accordance with § 180.300. Verification methods are provided in § 180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds. Per 2 CFR 200.303, non-federal entities receiving federal awards are required to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Kansas Department of Education and Kansas Department of Children and Families (Departments) did not include all required subaward information. Subawards underwent suspension and debarment verification from sam.gov but this process was not formally documented. Questioned costs: None. Context: Eleven of nineteen subawards selected for testing, totaling $991,788, did not include all required federal award information. Specifically, the following was omitted: • Federal Award Identification Number (FAIN) • Name of the Federal agency and contact information for awarding official of the pass-through entity • Assistance Listing Number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement • Identification of whether the award is research and development • In addition, for eleven of the eleven subawards tested, the Department did not maintain documentation evidencing that suspension and debarment verification was performed prior to issuing the subawards. Cause: The Department’s procedures were not sufficient to ensure that subawards included all required federal award information and that suspension and debarment verification was documented. Internal controls did not prevent or detect the errors. Effect: Excluding the required federal award information at the time of subaward issuance could result in subrecipients not properly administering the federal programs in accordance with federal regulations. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports when all federal award information is not provided to them. As a result of this condition, the federal awarding agency lacks full assurance that program funds were administered in compliance with federal requirements, including requirements related to vendor suspension and debarment. This condition limits the government’s ability to ensure proper oversight and stewardship of federal funds. Repeat Finding: No Recommendation: We recommend that the Departments develop a subaward template that includes all required federal award information and update its procedures and internal controls to ensure that all required federal award information is included in subawards at the time of issuance. We recommend that management enhance its procurement procedures to require and retain documented evidence that vendors are verified as not suspended or debarred prior to the award of contracts or payment of federal funds. Maintaining this documentation will help ensure compliance with federal requirements and support the government’s assurance that federal funds are expended only with eligible vendors. Views of responsible officials: There is no disagreement with the audit finding.
2025-027. Subrecipient Monitoring Federal Agencies: Department of Health and Human Services Federal Program Titles: Refugee and Entrant Assistance-State/Replacement Designee Administered Programs Assistance Listings: 93.566 Federal Grant ID Numbers: 2201SCRSSS & 2401SCRSSS Pass-Through Entity: Not applicable Award Period: October 1, 2022 through September 30, 2025 Type of Finding: Material weakness in internal control over compliance, material noncompliance Criteria: 2 CFR § 200.303(a) requires that the recipient and subrecipient establish and maintain effective internal control over the federal award that provides reasonable assurance that the recipient or subrecipient is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. 2 CFR § 200.332(c) requires that all pass-through entities evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. 2 CFR § 200.332(e) requires that all pass-through entities monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. Condition: The Department did not maintain the subrecipient monitoring and did not comply with federal subrecipient monitoring requirements. Cause: The Department has not fully implemented the corrective action associated with this finding from the prior year. Effect: The Department is not in compliance with federal subrecipient monitoring requirements. Questioned Costs: None, as the finding relates to monitoring and not unallowable expenditures. Context: The checklists were not maintained, and the Department could not provide the completed checklist to demonstrate monitoring of any subrecipients during FY 2025. For one subrecipient, the Department did not provide documentation to demonstrate that a verification was performed to confirm the subrecipient was not excluded or disqualified. Additionally, the Department failed to evaluate subrecipients for risks, create a monitoring plan that considered those risks, or sufficiently monitor and address the audit findings of the subrecipient. Prior Year Single Audit Finding Number: 2024-021 Recommendation: We recommend the Department continue its efforts to strengthen their current policies and procedures and to ensure that the subrecipient monitoring checklist is being completed and maintained. Views of responsible officials and planned corrective actions: See management’s response on page 198.
Finding 2025-001 Monitoring of Subrecipients Research and Development Cluster National Aeronautics and Space Administration (ALN 43.001) Grant Number: 80NSSC23K1013 Statistically Valid Sample: No, and it was not intended to be Prior Year Finding: Not a repeat finding. Finding Type: Significant Deficiency and Noncompliance Criteria: According to 2 CFR 200.332(d), a pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations and the terms and conditions of the subawards, and that the subaward performance goals are achieved, Accordingly, 2 CFR 200.332(d)(3) and 2 CFR 200.521 state that a pass-through entity is required to issue a management decision on federal awards audit findings within six months of the acceptance of the report by the Federal Audit Clearinghouse and ensure the subrecipient takes timely and appropriate corrective action on all audit findings. In addition, 2 CFR 200.303 requires nonfederal entities to, among other things, establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure single audit reports are reviewed and completed in a timely manner, and management decisions are issued within required timeframes. Condition and Context: The Garden performs a comprehensive risk assessment for all subrecipients and has established monitoring procedures which are applied to each of their four subrecipients throughout the life of the grant. These procedures include a detailed review of invoices submitted for reimbursement by the subrecipient and communication with the subrecipient as needed throughout the year. While the Garden obtained a copy of the subrecipients’ single audit report during the initial risk assessment process, the Garden did not obtain or review the most recently issued single audit report for each subrecipient during 2025 to determine if there were any findings related to their federal awards which would require the Garden to issue a management decision on audit findings. Cause: Management had a control in place to obtain the subrecipient single audit reports upon entering into the subaward agreements. However, the control was not properly designed to obtain subrecipient single audit reports annually in the subsequent years the agreement was still in place.. Effect: Failure to obtain and review the subrecipient single audit reports in a timely manner may result in the Garden not being aware of a material noncompliance by a subrecipients and the Garden not documenting management’s decision timely in accordance with the guidance. Questioned Costs: No questioned costs were noted as a result of the audit procedures performed. Recommendation: We recommend the Garden establish procedures to ensure subrecipient single audit report are obtained and reviewed on an annual basis. In addition, the Garden should document whether a management decision was prepared or whether it is not required based on review of the findings, if any. Views of Responsible Officials: Management agrees with the finding. Subsequent to year end, Management has obtained and reviewed Single Audit filings for all its Subrecipients from the Federal Audit Clearinghouse. In their review of the Subrecipient Single Audit Reports, they did not note any findings related to its Federal programs. Management has implemented a control to continue to obtain and review the Single Audit filings for its Subrecipients on an annual basis.
CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – SUBRECIPIENT MONITORING Finding Number: 2025-004 State Agency Number: DEV-02 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Numbers / Years: SLFRP2610 / 2021 SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-005 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2. C.F.R. § 200.332, which establishes requirements over subawards for pass-through entities and states: All pass-through entities must: . . . (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. . . . It is management’s responsibility to design and implement internal control procedures over subrecipient monitoring to ensure federal funds are being spent for allowable purposes and in accordance with program requirements. It is also management’s responsibility to monitor these control procedures to ensure they are operating effectively and as intended. During state fiscal year 2025, the Department expended approximately $389.5 million in subawards to SLFRF subrecipients. The Department created several subprograms for various development and community-related activities as part of the SLFRF program. The subrecipients of these subprograms were required to submit a quarterly program report which includes data on projects funded, expenditures, contracts, and subawards equal to or greater than $50,000, to the Department through the Salesforce System. The Department’s Community Services Division oversees the Water Sewer Quality program and did not obtain the required quarterly program reports 13 out of 23 (56.5%) subrecipients selected for testing. Further, the Community Services Division did not have a process in place to follow-up with its subrecipients to obtain the missing program reports for a majority of the audit period [until April 2025]. Without adequate procedures in place to collect program reports from subrecipients to monitor compliance with federal statutes, laws, and regulations, there is an increased risk subrecipients may misuse federal funds for unauthorized purposes. This could lead to fines, penalties, or repayment of program funds being imposed by the federal grantor agency. Based on discussions with management, the lapse in monitoring was caused by employee turnover, slowing the monitoring of subrecipient’s report submissions. We recommend the Department develop and re-evaluate its internal control procedures to ensure all subprograms and subrecipients are adequately monitored for program compliance. We also recommend the Department evaluate existing control procedures to reasonably ensure the quarterly program reports submitted through the Salesforce System are timely, accurate, and complete. These procedures should be adequately documented and maintained to ensure the internal controls are in place and operating as management intended. Management should periodically monitor these procedures to ensure they are working as intended.
(2025-017) Title: Internal control over SNAP subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. Condition: The Supplemental Nutrition Assistance Program (SNAP) is administered by the Office for Family Independence (OFI). In addition to providing monthly benefits to eligible households to purchase nutritious foods, SNAP has administrative funding that may be used to educate the public on nutrition and to assist SNAP clients in gaining the skills, training, and work experience needed to build a career and achieve long-term stability. The Office of the State Auditor (OSA) tested all 7 contracts with 4 SNAP subrecipients for compliance with: • award identification requirements, and found: o 6 contracts did not include Federal award identification numbers; and o 1 contract did not include the Assistance Listing title and number. • subrecipient risk evaluation procedures. OFI provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: In fiscal year 2025, OFI provided $5.1 million from a total of $19.7 million in SNAP administrative funds to SNAP subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures to: • ensure that all required information is included in contracts and contract amendments. This will ensure compliance with Federal requirements. • require evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-13 Management’s Response: The Department partially agrees with the finding. We acknowledge six of the contracts did not include the Federal award identification number, and that one contract did not include the assistance listing title and number. The Department disagrees that we do not have adequate subrecipient risk evaluation procedures. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: Patricia Dushuttle, Special Projects Manager- SNAP, DHHS, 207-215-0995 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, 6 of the 7 subawards tested were not competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit (DOA) performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that subrecipient monitoring procedures are performed by program personnel as a result of a risk evaluation conducted by DOA. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1108-04)
(2025-020) Title: Internal control over CNC subrecipient monitoring procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 210.18; 7 CFR 225.7; U.S. Department of Agriculture Policy Memo SP 46-2015 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. The Department must conduct administrative reviews of School Food Authorities (SFAs) participating in the National School Lunch Program (NSLP) and the School Breakfast Program (SBP). These procedures must also be followed, as applicable, to conduct administrative reviews of the Special Milk Program (SMP) and the Fresh Fruit and Vegetable Program (FFVP). Documented corrective action is required for any degree of violation of general or critical areas identified in an administrative review. Corrective action may be provided at the time of the review; however, it must be postmarked or submitted electronically to the State agency no later than 30 days from the deadline for completion of each required corrective action. The State agency must maintain any documented corrective action on file for review by the Food and Nutrition Service (FNS). The Department must withhold all program payments to an SFA if: • documented corrective action for critical area violations is not provided with deadlines specified; or • corrective action for critical area violations was not completed. FNS may suspend or withhold program payments, in whole or in part, to those states failing to withhold payments in accordance with regulations and may withhold administrative funds. The Department must review sponsors to ensure compliance with Summer Food Service Program (SFSP) regulations. The Department is required to conduct a review of base year certification and benefit issuance documentation for any SFA requesting approval to participate in NSLP or SBP using U.S. Department of Agriculture (USDA) Special Provision 2, which is a provision established to reduce application burdens and simplify claim procedures. The review must occur at some point during the base year. If errors are identified as a result of the review, the Department must adjust all of the SFA’s closed claims that occurred in the current school year. Condition: The Child Nutrition Cluster (CNC) includes the NSLP, SBP, SMP, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of CNC programs for the State. DOE partners with local SFAs and sponsors to provide benefits to school-aged children. DOE has assigned subrecipient monitoring responsibilities, which include administrative reviews and other reviews as needed, to the Child Nutrition Services (CNS) division. Administrative reviews of all SFAs and sponsors are required at least once every 5 years; however, regulations also specify that high-risk SFAs and sponsors must receive targeted follow-up within 2 years. CNS utilizes a spreadsheet to track and facilitate the reviews, and a USDA questionnaire and information within the Child Nutrition Program (CNPWeb) system to document the completion of the review and related corrective action. CNS does not have a mechanism to centrally track the high-risk SFAs and sponsors to ensure follow-up occurs. CNS is required to retain documentation to support all elements of the administrative reviews and to demonstrate SFA and sponsor compliance with the program, even if corrective action occurs onsite during the review. The Office of the State Auditor (OSA) tested 16 administrative reviews completed by CNS and found: • Performance Standard 1 findings, deemed critical findings by USDA, were identified in 1 NSLP review, but required follow up fiscal action was not properly tracked. • Performance Standard 2 findings, also deemed critical by USDA, were identified in 3 reviews, but follow up corrective actions were not properly tracked, received, and/or approved. In addition, corrective action was not provided within 30 days for 2 of the 3 reviews. • corrective action for 3 reviews required fiscal action; 2 reviews indicated a reduction of a future claim would be processed, and 1 review indicated a check for repayment to the State would be received. Documentation in the CNPWeb system: o was not available to support that 2 required fiscal actions were taken, and o conflicted with the tracking spreadsheet for 1 fiscal action. • corrective action responses were missing for 4 reviews, 1 of which was marked as approved by CNS. • corrective action responses submitted by 2 SFAs were missing CNS approval information, but the reviews were marked as closed. • corrective action responses submitted by 3 SFAs were missing SFA contact information and submission dates. • the date for required corrective action to be provided was omitted for 4 reviews. • corrective action for 1 review was received late. • USDA questionnaire sections related to SFSP procurement were erroneously excluded for 4 reviews. • USDA questionnaires were not fully completed for 2 reviews. • the review tracking spreadsheet was not fully completed or conflicted with information obtained from the administrative review for 10 reviews. • the SFSP administrative review tracking spreadsheet was not designed to properly track corrective action, related due dates, and CNS review and approval dates; this was noted in all 8 SFSP administrative reviews tested. CNS updated the design of the tracking spreadsheet in fiscal year 2025 to ensure this information is properly tracked. OSA selected a non-statistical random sample. In addition to administrative reviews, CNS must perform base year reviews for all SFAs and sponsors that have applied to participate in USDA Special Provision 2. These base year reviews provide the required information necessary to determine the level of claims the SFA or sponsor may submit in the subsequent 3 years. In fiscal year 2025, CNS identified 4 SFAs that required a base year review, 2 of which were completed alongside the SFA’s administrative review. OSA tested the remaining 2 base year reviews and identified that neither review was completed by CNS as required. OSA cannot determine if unallowable costs exist through the audit of subrecipient monitoring activities, as required information was not collected through OSA’s subrecipient monitoring testing procedures; however, OSA reported questioned costs in the audit of allowable costs/cost principles and eligibility. See findings 2025-019 Internal control over CNC claim reimbursements needs improvement and 2025-020 Internal control over CNC eligibility needs improvement, respectively. Context: In fiscal year 2025, the Department provided 241 subrecipients with $70.7 million in CNC program funds, which represents 99 percent of CNC programs’ $71.3 million total expenditures. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. • Base year reviews provide authorization for the level of allowable claims an SFA or sponsor can claim in subsequent periods; if a base year review is not completed and participation in USDA Special Provision 2 continues, SFAs and sponsors could be underclaiming or overclaiming costs. • Potential questioned costs and disallowances Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that: • reviews are completed as required and supporting documentation is retained; • required corrective and fiscal actions are implemented, reviewed, and completed; and • high-risk SFAs and sponsors are tracked and considered in planning follow-up reviews. Corrective Action Plan: See F-15 Management’s Response: The Department partially agrees with this finding. Regulatory requirements for the administrative review process including corrective and fiscal action were met. Staff will receive training on tracking sheet completion and additional internal control measures that document requirements were met. The 2026 SFSP tracker has been updated to clarify the date of corrective action and now reads “Corrective Action Received Date”. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: The exceptions noted in the finding outline instances where documentation in support of the administrative review process, including required corrective action by subrecipients, could not be provided or was incomplete. The Department’s existing policies and procedures do not provide assurance that administrative reviews are monitored, completed, documented, and considered in subsequent reviews as required by Federal program regulations. The finding remains as stated.
(2025-023) Title: Internal control over CNC subrecipient audit monitoring needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner’s Office Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must verify that subrecipients are audited as required. Condition: The Department of Education (DOE) is responsible for the administration of Child Nutrition Cluster (CNC) programs for the State. DOE partners with subrecipient School Food Authorities and sponsors to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. DOE is required to verify that all subrecipients are audited as required when Federal award expenditures exceed the Single Audit threshold. DOE utilizes a spreadsheet to track and facilitate subrecipient audit monitoring. The spreadsheet tracks each DOE subrecipient, the subrecipient’s auditor, the date of receipt of the Single Audit report, the date the report was reviewed by DOE, any requests for an extension, any exceptions noted within the Single Audit report, and a corrective action plan due date, as applicable. The Office of the State Auditor (OSA) tested 22 CNC subrecipients required to receive a Single Audit and found: • 2 subrecipients were granted submission extensions; however, both audit reports were received after the approved extension date and documentation for an additional extension or late receipt could not be provided. • 1 subrecipient was documented on the tracking spreadsheet; however, the only information included was the subrecipient’s name. In addition, email communications indicated multiple expired extensions, but this information was not included or tracked by DOE. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department provided 241 subrecipients with $70.7 million in CNC program funds, which represents 99 percent of CNC programs’ $71.3 million total expenditures. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients may not be undergoing audits as required by Federal regulations. Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that all CNC subrecipients are properly tracked and submit Single Audit reports as required. Corrective Action Plan: See F-16 Management’s Response: The Department agrees with this finding. Audit tracking was previously performed through a manual process. As the result of a RFP, an upgrade to the Maine Education Financial System will include an automated tracking system and dashboard to more effectively manage receipt of school administrative unit audits. In the interim, the Policy and Procedure Manual will be updated to include supervisory review of the tracking spreadsheet on a monthly basis. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 25-1203-07)
(2025-032) Title: Internal control over Health Disparities program subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services Public Safety State Bureau: Maine Center for Disease Control & Prevention Emergency Medical Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. MeCDC has a memorandum of understanding in place with the Department of Public Safety’s Emergency Medical Services (EMS) Bureau to assist in administering the Health Disparities program. The Office of the State Auditor (OSA) tested 11 contracts or contract amendments issued by MeCDC and 3 contracts issued by EMS for compliance with: • award identification requirements and found: o 9 contract amendments issued by MeCDC did not include the name of the Federal agency issuing the award, the Federal award identification number, or the Federal award date; and o all 3 contracts issued by EMS did not include the Federal award identification number, the Federal award date, the assistance listing title and number, or the indirect cost rate for the Federal award. • subrecipient risk evaluation procedures and found through inquiry of program personnel at MeCDC and EMS that policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. As a result, subrecipient monitoring activities were the same for all subrecipients/contracts, regardless of risk. • subrecipient monitoring requirements and found that documentation could not be provided to support that: o follow-up occurred regarding late receipt of an incomplete financial report for 1 contract overseen by MeCDC; o an appropriate response was completed to previously identified inaccurate expense reporting for 1 contract overseen by MeCDC; o a required report was reviewed for 1 contract overseen by EMS; and o required reports were received or that appropriate action was taken in response for 2 contracts overseen by EMS. OSA determined that payments made to subrecipients for the aforementioned reporting deficiencies were allowable based upon subsequent reports and other monitoring procedures performed. OSA utilized a risk-based approach to select 2 contracts issued by MeCDC and selected a non-statistical random sample of all other contracts. Context: In fiscal year 2025, MeCDC provided $3.2 million from a total of $6.2 million and EMS provided $301,000 from a total of $449,000 to Health Disparities program subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Potential future questioned costs and disallowances Recommendation: We recommend that the Department implement policies and procedures: • to ensure that all required information is included in contracts and contract amendments; • that require evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed; and • implement policies and procedures to ensure all required subrecipient monitoring activities are performed. Corrective Action Plan: See F-19 Management’s Response: DHHS Response: The Department partially agrees with this finding. We agree with the recommendations that the Department implement policies and procedures to ensure all required information is included in contracts and that all required subrecipient monitoring is completed. The Department disagrees that we do not have subrecipient risk evaluation procedures. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. DHHS Contact: Eden Hale, Associate Director, Division of Population Health Equity, Maine CDC, 207-441-1090 DPS Response: The Department partially agrees with this finding. The Department of Public Safety acknowledges that EMS was missing policies and procedures around specific subrecipient monitoring activities and required contract language identifying the Federal Grant. However, the Department has these policies and procedures in place for the Contract/Grant Team which oversees the majority of the Federal Funding for the Department. The Department will ensure all Bureaus receive guidance, training, and policies and procedures. DPS Contact: Derek Gorneau, Assistant to the Commissioner, DPS, 207-530-3531 Auditor’s Concluding Remarks: DHHS: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. DPS: The Department asserts that policies and procedures are in place for the Contract/Grant Team, but did not demonstrate that these policies and procedures were adhered to in relation to contracts for the Health Disparities program. The finding remains as stated. (State Number: 25-1123-03)
(2025-036) Title: Internal control over PDG subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services Education State Bureau: Office of Child and Family Services Office of Teaching and Learning Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $128,333 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of subrecipients who received program funds during fiscal year 2025 and identified known questioned costs associated with 1 of those subrecipients based on various compliance attributes. Since circumstances are unique to each subrecipient, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. • ensure that the subrecipient takes corrective action on all Single Audit findings related to the subaward, other audit findings, site visits, and written notifications of adverse conditions which will impact the ability to meet milestones or the objectives of a subaward. Condition: The Every Student Succeeds Act/Preschool Development Grants (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Department of Health and Human Services’ (DHHS) Office of Child and Family Services (OCFS). DHHS has a memorandum of understanding in place with the Department of Education (DOE) to assist in administering PDG. OSA tested 2 contracts issued by OCFS and 2 contracts issued by DOE for compliance with: • award identification requirements, and found: o 2 contracts issued by OCFS did not include the Federal award identification number or the grant award number; and o 2 contracts issued by DOE did not include the Federal award identification number, the Federal award date, the assistance listing title and number, the name of Federal agency, the assistance listing title and number, identification of whether the Federal award is for research and development, or the indirect cost rate for the Federal award. • subrecipient risk evaluation procedures, and found through inquiry of program personnel at OCFS and DOE that policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. As a result, subrecipient monitoring activities were the same for all subrecipients/contracts regardless of risk. • subrecipient monitoring requirements, and found that OCFS did not identify an appropriate level of monitoring for 1 contract. Evidence of significant developments, including inability to meet performance goals, that impacted the subrecipient’s ability to meet the objectives of the subaward were present prior to quarterly reporting. OSA determined that payments made to this subrecipient for the aforementioned monitoring deficiencies were not allowable based upon subsequent financial reports and the results of other monitoring procedures performed during the fiscal year. Payments to the subrecipient were withheld after April 2025. OSA has questioned the full amount of program expenditures paid to this subrecipient during the fiscal year, totaling $128,333. OSA selected a non-statistical random sample of all PDG subrecipient contracts. Context: In fiscal year 2025, PDG expenditures totaled $11.5 million, of which approximately $910,000 was paid to OCFS subrecipients and $709,000 was paid to DOE subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Payments may be issued in error to subrecipients not in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. • Known questioned costs • Potential future questioned costs and disallowances Recommendation: We recommend that the Department enhance oversight and implement policies and procedures to ensure that: • all required information is included in contracts and contract amendments; • an evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring is performed; and • all required subrecipient monitoring activities are performed. Corrective Action Plan: See F-21 Management’s Response: The Departments partially agree with this finding. DHHS agrees that two contracts did not include the Federal award identification number or the grant award number. DOE agrees that two contracts did not include the Federal award identification number, the Federal award date, the assistance listing title and number, the indirect cost rate for the Federal award, name of Federal agency, assistance listing title and number, identification of whether the Federal award is for research and development, and the indirect cost rate for the federal award. The Departments disagree that subrecipient risk evaluation policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. DOE utilizes a risk assessment tool when developing monitoring of invoices associated with subrecipients. Contact: Tara Williams, Associate Director of Early Care & Education, OCFS, DHHS, 207-557-2342 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. DHHS’ existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. Furthermore, as noted in the Condition, OSA found that DHHS did not identify an appropriate level of monitoring for 1 contract. If DHHS had adequate controls in place over subrecipient risk evaluation requirements, appropriate subrecipient monitoring procedures would have been developed and performed in response to the subrecipient’s inability to meet the objectives of the subaward, including withholding payments to the subrecipient sooner. Additionally, the risk assessment tool that DOE refers to in Management’s Response only determines the frequency of invoicing (monthly or quarterly) and does not determine the level of subrecipient monitoring needed based on the subrecipient’s risk. The finding remains as stated. (State Number: 25-1122-04)
(2025-043) Title: Internal control over TANF subrecipient risk evaluation procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal regulations for the purpose of determining the appropriate level of subrecipient monitoring to be performed. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Department provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: The Department provided $35.0 million from a total of $104.9 million to TANF subrecipients during fiscal year 2025. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-23 Management’s Response: The Department disagrees with this finding. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1111-02)
(2025-047) Title: Internal control over TANF subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Department is required to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Office of the State Auditor (OSA) tested 9 contracts issued to Temporary Assistance for Needy Families (TANF) subrecipients and found that documentation could not be provided to support that: • required performance reports were received and that appropriate action was taken in response for 4 contracts; and • required reports were reviewed for 6 contracts. OSA determined that payments made to subrecipients for the aforementioned reporting deficiencies were allowable based upon subsequent reports and other monitoring procedures performed. OSA selected a non-statistical random sample. Context: The Department provided $35.0 million from a total of $104.9 million to TANF subrecipients during fiscal year 2025. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Potential future questioned costs and disallowances Recommendation: We recommend that the Department implement policies and procedures to ensure that all required reports are received from subrecipients and reviewed by program personnel, and that appropriate action is taken to address any deficiencies identified through subrecipient monitoring. Corrective Action Plan: See F-25 Management’s Response: The Department agrees with this finding. The Department will create a process to ensure the documentation of the review of sub-recipient performance reports. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-08)
(2025-054) Title: Internal control over CCDF subrecipient risk evaluation procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Child Care and Development Fund (CCDF) program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. The CCDF program contracts with subrecipients to administer the First 4 ME Pilot Project, a community-based, coordinated birth through kindergarten entry program which provides comprehensive, high-quality early child care and education to support a child’s school readiness. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal regulations for the purpose of determining the appropriate level of subrecipient monitoring to be performed. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Department provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: The Department provided $2.8 million from a total of $45.1 million to CCDF subrecipients during fiscal year 2025. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure that subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-27 Management’s Response: The Department disagrees with this finding. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: John Feeney, Chief Operating Officer, OCFS, DHHS, 207-626-8614 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While the Office of the State Auditor acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1114-05)
(2025-071) Title: Internal control over DG – PA program subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 2 CFR 200.521 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. The Department must issue a management decision for audit findings that relate to Federal awards provided to the subrecipient within 6 months of acceptance of the audit report by the Federal Audit Clearinghouse (FAC). Condition: The Maine Emergency Management Agency (MEMA) administers the Disaster Grants – Public Assistance (DG – PA) program for the State. MEMA is required to verify and document that Single Audits have been completed in the FAC and issue a management decision for audit findings related to awards to subrecipients. The Office of the State Auditor (OSA) tested 4 DG – PA program subrecipients subject to Single Audit requirements and found that documentation of review for 2 subrecipients could not be provided. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department expended $160.5 million in DG – PA program funds, of which $154.6 million was provided to 27 subrecipients. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients not complying with Federal statutes, regulations, or the terms and conditions of subawards may not be implementing appropriate corrective action in response to audit findings. Recommendation: We recommend that the Department enhance policies and procedures to ensure that adequate documentation is maintained and that subrecipient audits are received, reviewed, and appropriate action is taken in response to audit findings. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. The Department will publish and implement an updated subrecipient monitoring procedure to require more extensive and narrative documentation of the single audit review process, including: - a list of subrecipients required to file a single audit report for a given audit year - whether or not an audit had been filed as of the review date - analysis of audit findings as relevant - summary of required actions per the subrecipient monitoring procedure, and/or updates on actions/communications since the prior review period as relevant Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-05)
2025-002 – Subrecipient Monitoring – Internal Control and Compliance over Subrecipient Monitoring (Material Weakness) Identification of the Federal Program: Assistance Listing Number: 21.027 Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds Federal Agency: Department of Treasury Pass-Through Entity: N/A Federal Award Number and Award Year: N/A Criteria or Specific Requirement (Including Statutory, Regulatory, or Other Citation): C.F.R. § 200.332 prescribes that the pass-through entity must conduct monitoring activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Passthrough entity monitoring of the subrecipient must include: 1. Reviewing financial and performance reports required by the pass-through entity. 2. Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. 3. Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. 4. The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. The City’s Subrecipient Monitoring Policy and Procedures, effective April 17, 2024, requires departments to monitor subrecipients to ensure compliance with Uniform Guidance. The policy requires that prior to award, the department shall evaluate the subrecipient’s risk of noncompliance with the Uniform Guidance, and the terms and conditions of the subaward, which risk assessment shall be documented, 2 CFR § 200.332(b). The policy also states that the City shall monitor subrecipients on a quarterly basis (90 days) throughout the term of the agreement (department should establish a regular monitoring schedule and document all monitoring), to ensure all subrecipients comply with the Uniform Guidance, that the subaward is used for authorized purposes, and that the subaward performance goals are achieved, as follows 2 CFR § 200.332(d): Reviewing subrecipient’s financial and performance reports. Ensuring subrecipients provide timely reports and information, as required by the federal awards. Following up and ensuring the subrecipient takes timely and appropriate action on all deficiencies as detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings. Issuing a management decision on Audit Findings, as required by 2 CFR § 200.521 (Management Decision). Condition: During the review of subrecipient monitoring records, we tested all two (2) existing subrecipients during the fiscal year ended June 30, 2025, and noted the following: The fully executed subrecipient agreements were not provided. One subrecipient agreement was executed via internal resolution and email approval; another subrecipient’s agreement does not have sufficient identification and award details, omitting key funding terminology. The documentation of the review of Financial and Performance Reports, the Pre-Award Risk Assessments, or the performance of the required subrecipient monitoring procedures were not provided. Cause: These conditions resulted from staffing capacity constraints, which led to subrecipient monitoring procedures not being performed consistently since the implementation of the City’s new Monitoring Policy on April 17, 2024. Additionally, formal documentation processes were not fully established, resulting in informal approvals and incomplete documentation of Pre-Award Risk Assessments. Effect or Potential Effect: The City’s insufficient monitoring of the necessary subrecipient activities resulted to internal control and compliance requirement finding. Questioned Costs: None. Context: See condition above for context of the finding. Identification as a Repeat Finding, If Applicable: Yes. See prior year finding 2024-003. Recommendation: We recommended the City to fully implement its Monitoring Policy by formalizing subrecipient agreements, strengthening internal controls, and establishing consistent processes for documenting Pre-Award Risk Assessments and Financial and Performance Reports. Views of Responsible Officials: Management concurs.
2025-002 – Subrecipient Monitoring Cluster: Research and Development Cluster (“R&D”) Sponsoring Agency: Various – All R&D awards with subrecipients from 1 campus Award Name: Various - All R&D awards with subrecipients from 1 campus Award Number: Various Assistance Listing Title: Various – All R&D awards with subrecipients from 1 campus Assistance Listing Number: Various - All R&D awards with subrecipients from 1 campus Award Year: 2024-2025 Pass-through entity: All pass-through awards for 1 campuses with subrecipients Criteria 2 CFR 200.332(e) notes that pass-through entity monitoring of the subrecipient must include: • Reviewing financial and performance reports required by the pass-through entity. • Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. • Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by 2 CFR 200.521. Additionally, 2 CFR 200.332(g) notes that a pass-through entity must verify that every subrecipient is audited as required by the Uniform Guidance when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR 200.501. Condition Through testing of subrecipient monitoring activities across four campuses, we identified that one campus does not have a documented process to determine whether subrecipients obtained a Uniform Guidance audit, as required, nor a process to follow up on audit findings or issue management decisions when applicable, in accordance with 2 CFR 200.233(e) and (g). While the campus performs a detailed pre-award risk assessment prior to executing subaward agreements — which includes review of available Uniform Guidance audit reports — ongoing monitoring procedures do not consistently include a review of the most recent Uniform Guidance audit report during the period of performance. Subaward agreements at this campus are generally limited to one year; however, when agreements are continued without a formal renewal or monetary amendment, a subsequent risk assessment is not required. As a result, updated Uniform Guidance audit reports are not consistently obtained or reviewed to determine whether (1) the subrecipient met audit requirements, (2) findings exist that impact the federal program, and (3) a management decision is required. Specifically, of 25 subawards tested at this campus, 9 did not have evidence that the most recent Uniform Guidance audit report was obtained and reviewed during the award period. In instances where audit reports were reviewed, documentation indicates the review was performed for risk assessment purposes rather than to satisfy the ongoing monitoring and management decision requirements under 2 CFR 200.232(e) and (g). Cause The campus’ monitoring procedures rely on subrecipients to communicate applicable audit findings rather than requiring the campus to independently obtain and review the most recent Uniform Guidance audit reports on an annual basis. Although review of Uniform Guidance reports is incorporated into the prescribed subrecipient risk assessment process, the risk assessment is not consistently required throughout the period of performance. As a result, procedures do not ensure that updated audit reports are obtained, evaluated, and documented in accordance with the requirements of 2 CFR 200.233(e) and (g). Effect As a result of not performing and documenting an annual review of subrecipients’ Uniform Guidance audit reports, the campus may not identify audit findings that impact its federal programs or ensure that appropriate follow-up and management decisions are issued within the required timeframe. This increases the risk of noncompliance with 2 CFR 200.233(e) and (g) and may result in unaddressed deficiencies or questioned costs related to federal awards. Questioned Costs There are no questioned costs associated with this finding. Recommendation We recommend the campus revise its subrecipient monitoring policies and procedures to require the timely review of subrecipients’ Uniform Guidance audit reports throughout the period of performance. Procedures should ensure that audit reports are reviewed at least annually to (1) determine whether the subrecipient met audit requirements, (2) identify findings that impact the campus’ federal programs, and (3) document follow-up actions and issuance of management decisions, as required by 2 CFR 200.233(e) and (g). Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings.
2025-004 – Subrecipient Monitoring: Lack of Supporting Documentation for Subrecipient Monitoring Activities Cluster: Not applicable Sponsoring Agency: United States Agency for International Development (USAID) Award Name: USAID Foreign Assistance for Programs Overseas Award Number: 7200AA19CA00018, 7200AA21LE00003 Assistance Listing Title: USAID Foreign Assistance for Programs Overseas Assistance Listing Number: ALN 98.001 Award Year: 2024-2025 Pass-through entity: Not applicable Compliance Requirement: Subrecipient Monitoring Criteria or Specific Requirement Under 2 CFR 200.332, pass-through entities are required to monitor subrecipients to ensure federal funds are used for authorized purposes, comply with award terms, and meet performance objectives. Required monitoring activities include reviewing financial and performance reports, ensuring corrective actions are taken, resolving audit findings, and issuing management decisions when applicable. Pass-through entities must also verify that subrecipients obtain audits in accordance with 2 CFR Part 200, Subpart F. Identified Condition For subrecipient monitoring testwork across two campuses, one campus was unable to provide evidence of subrecipient monitoring activities for the sample of nine (9) subrecipients selected for testwork. Specifically, formal supporting documentation of monitoring procedures conducted by the campus, such as reviews of subrecipient annual work plans, activity reports, performance indicator reporting, progress reports, technical reports, expenditure reports, and site visit reviews, were not available. Cause The grant awards for this program were terminated by the federal agency during February 2025. Following program termination, key program personnel separated from the campus, including the program investigators responsible for subrecipient monitoring activities. The campus did not have a formal document maintenance system in place to ensure the program investigators’ records were properly maintained by the campus. Consequently, supporting documentation related to subrecipient monitoring activities could not be located. Effect Lack of supporting documentation for subrecipient monitoring activities prevents the campus from demonstrating compliance with subrecipient monitoring requirements under the program. As a result, this increases the risk of deficiencies in subrecipient performance and/or the potential for unallowable expenditures. Questioned Costs None. Recommendation We recommend that the campus strengthen its record retention policies and access controls to ensure continuity and accessibility of supporting documentation and records in the event of employee turnover. Additionally, we also recommend that a formal process is established to ensure all required records and documentation are properly maintained when key personnel (program investigators and others) separate from the campus. Management’s Views and Corrective Action Plan Management’s response is included in “Management’s Views and Corrective Action Plan” included at the end of this report after the summary schedule of status of prior audit findings.
2025-003: Accurate and Complete Schedule of Expenditures of Federal Awards (SEFA) Criteria or specific requirement: The Alliance must prepare a SEFA that is accurate and complete in accordance with 2 CFR 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). Condition and context: The Alliance did not prepare a SEFA that was accurate and complete in accordance with the Uniform Guidance, as the unadjusted totals for federal expenditures were not accurate and did not agree to underlying support. In addition, an immaterial amount of allowable expenses were included on the 2025 SEFA, that should have been included on the 2024 SEFA. Cause: The cause is due to limited internal controls related to the preparation and review of the SEFA. Effect or potential effect: Without adequate controls over this process, the Alliance may not identify all federal awards received and related compliance and reporting requirements applicable to each award. Questioned costs: None. Identification as a repeat finding, if applicable: This is a repeat finding. Recommendation: The Alliance must assign individuals who are experienced and knowledgeable in the compliance requirements of the Uniform Guidance to monitor all federal grants received to ensure that the Alliance has met the applicable compliance and reporting requirements of each federal award. Views of responsible officials: Refer to the Corrective Action Plan prepared by the Alliance in regard to this matter. 2025-004: Subrecipient Monitoring Identification of the federal program: Continuum of Care Program (AL # 14.267) Criteria or specific requirement: In accordance with Title 2 U.S. Code of Federal Regulations (CFR) Part 200.332, the Alliance must perform specific monitoring over subrecipients. The Alliance as the pass-through entity (PTE) is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.